24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 6f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 8c5b965e94ac… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8c5b965e94ac…. Threat score 100/100. 0/27 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8c5b965e94acb72916c13f30b1f684883f6f91b1f71fe38726c8096886ba08fd","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","8c5b965e94acb72916c13f30b1f684883f6f91b1f71fe38726c8096886ba08fd"],"about":{"@type":"SoftwareApplication","name":"Melty-Setup-1.0.72.exe","applicationCategory":["compressed","7zip"],"identifier":"8c5b965e94acb72916c13f30b1f684883f6f91b1f71fe38726c8096886ba08fd","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T45a,"Melty.exe" called "FindResourceW" with parameter "380" - (UID: 00000000-00002428) "Melty.exe" called "FindResourceW" with parameter "44000" - (UID: 00000000-00002316) "Melty.exe" called "FindResourceW" with parameter "44010" - (UID: 00000000-00002316) "Melty.exe" called "FindResourceW" with parameter "44001" - (UID: 00000000-00002316) "Melty.exe" called "FindResourceW" with parameter "44000" - (UID: 00000000-00001076) "Melty.exe" called "FindResourceW" with parameter "44010" - (UID: 00000000-00001076) "Melty.exe" called "FindResourceW" with parameter "44001" - (UID: 00000000-00001076) "Melty.exe" called "FindResourceW" with parameter "44000" - (UID: 00000000-00008000) "Melty.exe" called "FindResourceW" with parameter "44010" - (UID: 00000000-00008000) "Melty.exe" called "FindResourceW" with parameter "44001" - (UID: 00000000-00008000) "Melty.exe" called "FindResourceW" with parameter "44000" - (UID: 00000000-00006708) "Melty.exe" called "FindResourceW" with parameter "44010" - (UID: 00000000-00006708) "Melty.exe" called "FindResourceW" with parameter "44001" - (UID: 00000000-00006708)26:Tde1,"Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\locales\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\dist\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm64\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\ia32\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\arm64\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\x64\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\ia32\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\x64\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\node_modules\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\src\preload\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\src\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\app.asar.unpacked\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\resources\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\ (UID: 00000000-00007784)27:T56d,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Melty-Setup-1.0.72.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Melty-Setup-1.0.72.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "nsExec.dll") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp")28:T649,"Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.DAT\DOCOBJECT") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\UNKNOWN") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\UNKNOWN\DOCOBJECT") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\UNKNOWN\DOCOBJECT") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.DAT") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\.DAT\BROWSEINPLACE") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.DAT\BROWSEINPLACE") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\UNKNOWN\BROWSEINPLACE") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\UNKNOWN\BROWSEINPLACE") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\.DAT\CLSID") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.DAT\CLSID") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\UNKNOWN\CLSID") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\UNKNOWN\CLSID") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\SYSTEMPROPERTYHANDLERS") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\SYSTEMPROPERTYHANDLERS") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\PROPERTYHANDLERS\.DAT")29:T9a8,"Melty-Setup-1.0.72.exe" queried SystemProcessInformation at 00000000-00007784-00000C15-882876454 [PID: 7784] "Melty-Setup-1.0.72.exe" queried SystemProcessInformation at 00000000-00007784-00000C15-882883279 [PID: 7784] "Melty-Setup-1.0.72.exe" queried SystemProcessInformation at 00000000-00007784-00000C15-883101949 [PID: 7784] "Melty-Setup-1.0.72.exe" queried SystemProcessInformation at 00000000-00007784-00000C15-883108618 [PID: 7784] "Melty-Setup-1.0.72.exe" queried SystemProcessInformation at 00000000-00007784-00000C15-883325934 [PID: 7784] "Melty-Setup-1.0.72.exe" queried SystemProcessInformation at 00000000-00007784-00000C15-883334639 [PID: 7784] "Melty-Setup-1.0.72.exe" queried SystemProcessInformation at 00000000-00007784-00000C15-884548319 [PID: 7784] "Melty-Setup-1.0.72.exe" queried SystemProcessInformation at 00000000-00007784-00000C15-884555003 [PID: 7784] "cmd.exe" queried SystemProcessInformation at 00000000-00001376-00000C15-885967718 [PID: 1376] "cmd.exe" queried SystemProcessInformation at 00000000-00001376-00000C15-885974387 [PID: 1376] "cmd.exe" queried SystemProcessInformation at 00000000-00001376-00000C15-886242019 [PID: 1376] "cmd.exe" queried SystemProcessInformation at 00000000-00001376-00000C15-886248948 [PID: 1376] "tasklist.exe" queried SystemProcessInformation at 00000000-00007336-00000C15-886832418 [PID: 7336] "tasklist.exe" queried SystemProcessInformation at 00000000-00007336-00000C15-886839516 [PID: 7336] "tasklist.exe" queried SystemProcessInformation at 00000000-00007336-00000C15-887076264 [PID: 7336] "tasklist.exe" queried SystemProcessInformation at 00000000-00007336-00000C15-887083138 [PID: 7336] "tasklist.exe" queried SystemProcessInformation at 00000000-00007336-00000C15-887383810 [PID: 7336] "tasklist.exe" queried SystemProcessInformation at 00000000-00007336-00000C15-887390786 [PID: 7336] "tasklist.exe" queried SystemProcessInformation at 00000000-00007336-00000C15-888213727 [PID: 7336] "tasklist.exe" queried SystemProcessInformation at 00000000-00007336-00000C15-888221342 [PID: 7336] "Melty.exe" queried SystemProcessInformation at 00000000-00003472-00000C15-958599861 [PID: 3472] "Melty.exe" queried SystemProcessInformation at 00000000-00003472-00000C15-958607039 [PID: 3472] "Melty.exe" queried SystemProcessInformation at 00000000-00003472-00000C15-1007484001 [PID: 3472] "Melty.exe" queried SystemProcessInformation at 00000000-00003472-00000C15-1007490993 [PID: 3472]2a:T510,"Melty.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Melty\Code Cache\js\index-dir\temp-index" to "%APPDATA%\Melty\Code Cache\js\index-dir\the-real-index" "Melty.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Melty\Local Storage\leveldb\000001.dbtmp" to "%APPDATA%\Melty\Local Storage\leveldb\CURRENT" "Melty.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Melty\Code Cache\wasm\index-dir\temp-index" to "%APPDATA%\Melty\Code Cache\wasm\index-dir\the-real-index" "Melty.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Melty\installed-games-stages.json.2428.tmp" to "%APPDATA%\Melty\installed-games-stages.json" "Melty.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Melty\mods\game-libraries.json.b973d2ad-6e62-455b-99c9-1e8ade77a6e2.tmp" to "%APPDATA%\Melty\mods\game-libraries.json" "Melty.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Melty\mods\state.json.2428.1.tmp" to "%APPDATA%\Melty\mods\state.json" "Melty.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Melty\ddc81e9e-2358-4083-b4c3-41a72b5957eb.tmp" to "%APPDATA%\Melty\Local State" "Melty.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Melty\fb56d432-9231-453c-8bc2-fb307dbbe299.tmp" to "%APPDATA%\Melty\Preferences"2b:T126e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-139-00EB5B00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-140-00EC05A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-156-00EC011E Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00007336-26654-229-00EBF899 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00007336-26654-229-00EBF899 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00007336-26654-229-00EBF899 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007336-26654-229-00EBF899 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00007336-26654-229-00EBF899 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007336-26654-264-00EBEBB8 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007336-26654-264-00EBEBB8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-265-00EBA65B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-265-00EBA65B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-270-00EBE26E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-270-00EBE26E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-277-00EB939E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-277-00EB939E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-286-00EBDCC5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-286-00EBDCC5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-287-00EBCF9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-287-00EBCF9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-290-00EBA558 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-290-00EBA558 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-293-00EBD2BC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-293-00EBD2BC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-332-00EBB72F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-332-00EBB72F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-335-00EBB877 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-335-00EBB877 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-347-00EB88EF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-352-00EBAEF5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-352-00EBAEF5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-355-00EBDFC4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-355-00EBDFC4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-356-00EBDA8F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-356-00EBDA8F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-357-00EBD72D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-357-00EBD72D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-358-00EBD563 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-358-00EBD563 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-359-00EBD420 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-359-00EBD420 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-376-00EB9ED1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-376-00EB9ED1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-378-00EB278D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-378-00EB278D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-389-00EB8810 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007336-26654-390-00EB69B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007336-26654-390-00EB69B02c:T40b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption2d:Tc0b,Found XOR loop in file "nsis7z.dll" at offset 377388; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 423495; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 429493; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 430733; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 432095; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 433473; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 14196; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32458; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32489; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32520; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 39010; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 66588; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 118788; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 266651; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274623; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274752; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 417293; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 16577; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 423456; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 424610; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 427782; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 428606; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 429474; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 430714; code bytes = 8030 Found XOR loop in file "StdUtils.dll" at offset 101399; code bytes = 30d0 Found XOR loop in file "StdUtils.dll" at offset 2707; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 2896; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 3088; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 30152; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 30569; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34552; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34557; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34719; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 37953; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 37960; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 40217; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 43107; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 43120; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 101360; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3377; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3457; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3642; code bytes = 80302e:T6fb,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "Melty-Setup-1.0.72.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "Melty-Setup-1.0.72.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "Melty-Setup-1.0.72.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "nsis7z.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "SpiderBanner.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "nsExec.dll") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002428-00000C2C-912245050") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002428-00000C2C-927411892") Found reference to API "&runtime.sendMessage" (Indicator: "sendmessage"; Source: "00000000-00001076.00000000.126256.00020000.00000004.mdmp, 00000000-00001076.00000000.126256.00180000.00000004.mdmp, 00000000-00001076.00000000.126256.00594000.00000004.mdmp, 00000000-00001076.00000001.127149.00020000.00000004.mdmp, 00000000-00001076.00000001.127149.00180000.00000004.mdmp, 00000000-00001076.00000001.127149.00594000.00000004.mdmp") Found reference to API "postMessage" (Indicator: "postmessage"; Source: "00000000-00001076.00000001.127149.FC950000.00000002.mdmp") Found reference to API "&runtime.sendMessage" (Indicator: "sendmessage"; Source: "00000000-00002316.00000000.124337.00004000.00000004.mdmp, 00000000-00002316.00000000.124337.0054C000.00000004.mdmp, 00000000-00002316.00000000.124337.0059C000.00000004.mdmp, 00000000-00002316.00000001.125546.00004000.00000004.mdmp, 00000000-00002316.00000001.125546.0054C000.00000004.mdmp, 00000000-00002316.00000001.125546.0059C000.00000004.mdmp")2f:T2fa4,"Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000004f51900682096770200000000000000b0ebff35109ab6740000000044f51900201b9b77ffffffff54f51900581096773c109677e0ebff35109ab674d445b674d845b67434f5190030f519000d0000000d0000009003b874dc54ba74000000006cacb774d858ba74c8f51900608d9977fc0b4442feffffff60f51900900f96779003b87470f5190084d4b774dc54ba749003b8747cf51900a4d4b7749003b87498f519001a9ab6749003b874528b9577010000000100000017d4b774d8f5190086cab774000000004acab774487ea3e50100000001000000000000000000000000000000a8f519003dba19f418f61900f0ccb77428a70091feffffff (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000007c2700007c270000b02d8a006fa38e00b02d8a000000000010a48e0050172674b0e8ad770000000000f41900601726742ca48e0096f1257483f1e4ace8778c0010a48e000000000000000000301726745017267410a48e00000000000000000080f4190080f41900601726742ca48e0077ce257408a48e00e8778c0087ce2574000000000000000008a48e00000000003017267408a48e00e8778c00201b9b77ffffffff70f41900101e9677eb1d9677f0ce94e85cf419006810ac772ca48e0020000000b8a38e0008a48e000ec0c676443dfe2500000000e8778c00d5a38e001000000000b7257464f4190070cd2574a0f51900b0bacd76b0d73a53 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000cf78104c590f073409cf27348f781049f73f073020000008f73f0737fcb409f140000005822f17315000000000000001cf7810400000000e8f78104302bf0733f0833e8feffffff8f73f0736676f07364f781045cf7810468f7810478f781047cf7810402000000020000002ee8ec7380f78104d975f0730099f273f21cf1738cf78104ca15f073f21cf17398f78104ee15f073f21cf173b8f781040e11ec73f21cf1730978f0730100000001000000010000006b15f073f8f781044b17f073000000000117f073cfcb409f0100000001000000000000000000000000000000c8f7810404b64e7d38f88104302bf073af0c33e8feffffff08f88104 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006400140000000800140000008a0094086400000000009008640020ea8104febaaa77080014000000000008000000050000006cea8104f0bd477600008a0008001400140000008c0b0071008000000a00000005000000ce9c413864ea8104f4ec8104b0ac7074ffffffffa4ea810472fa5b7498ea81047cce4d7472fa5b740100000000000000020000007cce4d74d8ea81040000000080c35c7480fa5b74d8061d036cf181046ef18104e0e181751a9c4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000000043003a005c00550020000000d00764000000640000000000000000000000000010518a000000000000000000000000000200000020000000c8016400000000000400000000006400120000000000000000008a00fe9f413874e9810408ea8104b0ac7074ffffffffb0e9810472fa5b74120000007cce4d7472fa5b740100000000000000020000007cce4d74dce98104540be2050000000080fa5b7410000000fcffffff00000000b0e98104 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006400140000000800140000008a0094086400000000009008640020ea8104febaaa77080014000000000008000000050000006cea8104f0bd477600008a0008001400140000008c0b0071008000000a00000005000000ce9c413864ea8104f4ec8104b0ac7074ffffffffa4ea810472fa5b7498ea81047cce4d7472fa5b740100000000000000020000007cce4d74d8ea81040000000080c35c7480fa5b7418051d036cf181046ef18104e0e181751a9c4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006400140000000800140000008a00940864000000000090086400f0ea8104febaaa77080014000000000008000000050000003ceb8104f0bd477600008a000800140014000000dc0a0071008000000a00000005000000be9d413834eb8104c4ed8104b0ac7074ffffffff74eb810472fa5b7468eb81047cce4d7472fa5b740100000000000000020000007cce4d74a8eb81040000000080c35c7480fa5b74381900033cf281043ef28104e0e18175ca9d4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000370300000000000002001ce88104b0e8ad777c153a9ffeffffff84e781046dfcae770000000094fcae770800350300008a0008003503e4e78104000000005900ac773ce78104ec444976a4e78104b0e8ad7734093a9fee91413884e78104d0ea8104b0ac7074ffffffffc4e7810472fa5b743c0900007cce4d7472fa5b740100000000000000020000007cce4d74f0e781042cee81047c01010380fa5b7400008a000000000008003503000000003a914138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000000043003a005c00550020000000d007640000006400000000000000000000000000c00103030000000000000000000000000200000020000000c8016400000000000400000000006400120000000000000000008a00ae9c413844ea8104d8ea8104b0ac7074ffffffff80ea810472fa5b74120000007cce4d7472fa5b740100000000000000020000007cce4d74acea8104840401030000000080fa5b7410000000fcffffff0000000080ea8104 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000702893004a04000044008104b8da8104ace5aa77dfe9aa775ce00cec300200003802000000008a000f00000f0000000000000000000000000200000200000000fcd10825000000005a00005a60da8104f8da81041eaf413894d98104e0dc8104b0ac7074ffffffffd4d9810472fa5b74000000007cce4d7472fa5b740100000000000000020000007cce4d7400da81043ce08104dcf8000380fa5b746828930000008a0000000000000000002aaf4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031008104b4e30cecccd881042cd98104f4ed81045c000000b602f4028cdb8104caffa877b602f40280d981045c0000009802f40230dc8104f2ffa87700000000000000001eaf413894d98104e0dc8104b0ac7074ffffffffd4d9810472fa5b74acd981047cce4d7472fa5b740100000000000000020000007cce4d7400da81043ce081047c01010380fa5b74a29447762a0000008038fd02000000002aaf4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031008104b4e30cecccd881042cd98104f4ed81045c0000002604f4028cdb8104caffa8772604f40280d981045c0000000804f40230dc8104f2ffa87700000000000000001eaf413894d98104e0dc8104b0ac7074ffffffffd4d9810472fa5b74acd981047cce4d7472fa5b740100000000000000020000007cce4d7400da81043ce08104dcf8000380fa5b74a294477626000000c8b39200000000002aaf4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031008104b4e30cecccd881042cd98104f4ed81045c000000360ef4028cdb8104caffa877360ef40280d981045c000000180ef40230dc8104f2ffa87700000000000000001eaf413894d98104e0dc8104b0ac7074ffffffffd4d9810472fa5b74acd981047cce4d7472fa5b740100000000000000020000007cce4d7400da81043ce081042cfd000380fa5b74a2944776290000004033fd02000000002aaf4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031008104b4e30cecccd881042cd98104f4ed81045c000000e609f4028cdb8104caffa877e609f40280d981045c000000c809f40230dc8104f2ffa87700000000000000001eaf413894d98104e0dc8104b0ac7074ffffffffd4d9810472fa5b74acd981047cce4d7472fa5b740100000000000000020000007cce4d7400da81043ce08104440c010380fa5b74a29447762700000040ad9200000000002aaf4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031008104b4e30cecccd881042cd98104f4ed81045c0000002604f4028cdb8104caffa8772604f40280d981045c0000000804f40230dc8104f2ffa87700000000000000001eaf413894d98104e0dc8104b0ac7074ffffffffd4d9810472fa5b74acd981047cce4d7472fa5b740100000000000000020000007cce4d7400da81043ce08104440c010380fa5b74a29447762a0000008035fd02000000002aaf4138 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031008104b4e30cecccd881042cd98104f4ed81045c000000560bf4028cdb8104caffa877560bf40280d981045c000000380bf40230dc8104f2ffa87700000000000000001eaf413894d98104e0dc8104b0ac7074ffffffffd4d9810472fa5b74acd981047cce4d7472fa5b740100000000000000020000007cce4d7400da81043ce08104a403010380fa5b74a294477629000000203bfd02000000002aaf4138 (UID: 00000000-00007784)30:T41d,"Melty-Setup-1.0.72.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Melty-Setup-1.0.72.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Melty.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Melty.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")31:Tc83,"Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\Crashpad\metadata" at 00000000-00002428-00000C17-919635617 "Melty.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00002428-00000C17-919829091 "Melty.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002428-00000C17-920036386 "Melty.exe" queries volume information of "C:\Users" at 00000000-00002428-00000C17-920036780 "Melty.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00002428-00000C17-920037335 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00002428-00000C17-920037679 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00002428-00000C17-920038003 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs" at 00000000-00002428-00000C17-920038380 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\melty" at 00000000-00002428-00000C17-920038783 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\melty\resources" at 00000000-00002428-00000C17-920039232 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\melty\resources\app.asar" at 00000000-00002428-00000C17-920039900 "Melty.exe" queries volume information of "C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm" at 00000000-00002428-00000C17-921904546 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\sentry" at 00000000-00002428-00000C17-922091445 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\sentry" at 00000000-00002428-00000C17-922094469 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\sentry\queue" at 00000000-00002428-00000C17-922097161 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\sentry\session.json" at 00000000-00002428-00000C17-922097846 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\sentry\queue" at 00000000-00002428-00000C17-922098169 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\sentry\queue" at 00000000-00002428-00000C17-922101939 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\sentry" at 00000000-00002428-00000C17-922102731 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty" at 00000000-00002428-00000C17-927966416 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Melty\mods" at 00000000-00002428-00000C17-927998720 "Melty.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\inspector-worker.cjs" at 00000000-00002428-00000C17-928384701 "Melty.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002428-00000C17-928388991 "Melty.exe" queries volume information of "C:\Users" at 00000000-00002428-00000C17-928389343 "Melty.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00002428-00000C17-92838983432:T636,"Melty-Setup-1.0.72.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CBD704C5-5A32-5F56-B24F-E3BE5A61D42A") "Melty-Setup-1.0.72.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MELTY-SETUP-1.0.72.EXE") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "PUBLISHER") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "INSTALLLOCATION") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYICON") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "UNINSTALLSTRING") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "windows-inspector.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "PUBLISHER")33:T4d8,"Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\2B45CA4F1FAC7F93EC09EABC096123B1E95C0108"; Key: "BLOB") "Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\31F9FC8BA3805986B721EA7295C65B3A44534274"; Key: "BLOB") "Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "Melty.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")34:T462,"Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter %TEMP%\nsnC9A2.tmp (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\melty (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "CreateDirectoryW" with parameter %TEMP%\nsnC9A2.tmp\7z-out (UID: 00000000-00007784)35:T72c,"Melty-Setup-1.0.72.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd.exe" /s /c ""%WINDIR%\system32\tasklist.exe" /FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq Melty.exe" /FO" - (UID: 00000000-00007784), "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\tasklist.exe" /FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq Melty.exe" /FO csv" - (UID: 00000000-00001376), "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\find.exe" /I "Melty.exe"" - (UID: 00000000-00001376), "Melty.exe" called "CreateProcessW" with parameter "%APPDATA%\M" - (UID: 00000000-00002428), "Melty.exe" called "CreateProcessW" with parameter "reg.exe DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize /v StartupDelayInMSec /f" - (UID: 00000000-00002428), "Melty.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\Programs\melty\Melty.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en" - (UID: 00000000-00002428), "Melty.exe" called "CreateProcessW" with parameter "reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v gg.melty.desktop /t REG_SZ /d "\"%LOCALAPPDATA%\" - (UID: 00000000-00002428), "Melty.exe" called "CreateProcessW" with parameter "%LOCALAPPDATA%\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --generation 1" - (UID: 00000000-00002428), "Melty.exe" called "CreateProcessW" with parameter "%LOCALAPPDATA%\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names" - (UID: 00000000-00002428), "Melty.exe" called "CreateProcessW" with parameter ""%APPDATA%\Melty"" - (UID: 00000000-00002428), "Melty.exe" called "CreateProcessW" with parameter "%LOCALAPPDATA%\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --generation 2" - (UID: 00000000-00002428)36:T482,"Melty-Setup-1.0.72.exe" called "NtCreateNamedPipeFile" with parameter "pipe" - (UID: 00000000-00007784) "cmd.exe" called "NtCreateNamedPipeFile" with parameter "pipe" - (UID: 00000000-00001376) "Melty.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_2428_ZHPTIQIOVKJWBTIC" - (UID: 00000000-00002428) "Melty.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.2428.2152.11793255520657720437" - (UID: 00000000-00002428) "Melty.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.2428.2152.15443884749622196807" - (UID: 00000000-00002428) "Melty.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\18446744073709551615-2428" - (UID: 00000000-00002428) "Melty.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\0-2428" - (UID: 00000000-00002428) "Melty.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\1-2428" - (UID: 00000000-00002428) "Melty.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.2428.2152.2277927532155863993" - (UID: 00000000-00002428) "Melty.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\2-2428" - (UID: 00000000-00002428)37:T4be0,"Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %TEMP%\nsnC9A2.tmp\System.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %TEMP%\nsnC9A2.tmp\StdUtils.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %TEMP%\nsnC9A2.tmp\SpiderBanner.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %TEMP%\nsnC9A2.tmp\nsExec.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %TEMP%\nsnC9A2.tmp\nsis7z.dll (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "LoadLibrary" with a parameter %TEMP%\nsnC9A2.tmp\WinShell.dll (UID: 00000000-00007784) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00007336) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007336) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007336) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007336) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007336) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007336) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-power-base-l1-1-0.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00002428) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-power-base-l1-1-0.dll (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003472) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007460) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter ffmpeg.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter DWriteCore.dll (UID: 00000000-00002316) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter ffmpeg.dll (UID: 00000000-00001076) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter ffmpeg.dll (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008000) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter ffmpeg.dll (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00006708) "Melty.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006708)38:T889,"Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Code Cache\js\index-dir\the-real-index & %APPDATA%\Melty\Code Cache\js\index-dir\todelete_7d10f2f1a917fc68 (UID: 00000000-00002428) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Code Cache\js\index-dir\temp-index & %APPDATA%\Melty\Code Cache\js\index-dir\the-real-index (UID: 00000000-00002428) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Code Cache\wasm\index-dir\the-real-index & %APPDATA%\Melty\Code Cache\wasm\index-dir\todelete_aa6a802bd4166d41 (UID: 00000000-00002428) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Local Storage\leveldb/000001.dbtmp & %APPDATA%\Melty\Local Storage\leveldb/CURRENT (UID: 00000000-00002428) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Code Cache\wasm\index-dir\temp-index & %APPDATA%\Melty\Code Cache\wasm\index-dir\the-real-index (UID: 00000000-00002428) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\ddc81e9e-2358-4083-b4c3-41a72b5957eb.tmp & %APPDATA%\Melty\Local State (UID: 00000000-00002428) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\fb56d432-9231-453c-8bc2-fb307dbbe299.tmp & %APPDATA%\Melty\Preferences (UID: 00000000-00002428) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Session Storage/000001.dbtmp & %APPDATA%\Melty\Session Storage/CURRENT (UID: 00000000-00002428) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Shared Dictionary\cache\index-dir\the-real-index & %APPDATA%\Melty\Shared Dictionary\cache\index-dir\todelete_cab384cb715142fd (UID: 00000000-00007460) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Shared Dictionary\cache\index-dir\temp-index & %APPDATA%\Melty\Shared Dictionary\cache\index-dir\the-real-index (UID: 00000000-00007460) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Cache\No_Vary_Search\snapshot-new.baf & %APPDATA%\Melty\Cache\No_Vary_Search\snapshot.baf (UID: 00000000-00007460) "Melty.exe" called "MoveFileW" with parameter %APPDATA%\Melty\Network\10cee4a5-627c-4827-9dfa-07b1c12ad783.tmp & %APPDATA%\Melty\Network\Network Persistent State (UID: 00000000-00007460)39:T1576e,"Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Int64Op (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Store (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetParameter (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Show (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Alloc (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CloseToolhelp32Snapshot (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter CloseToolhelp32SnapshotW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetModuleFileNameExWW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Exec (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter FindFirstStreamW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter FindNextStreamW (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter Extract (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter GetParentPath (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter SetLnkAUMI (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter TestParameter (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00007784) "Melty-Setup-1.0.72.exe" called "GetProcAddress" with a parameter ExecShellAsUser (UID: 00000000-00007784) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001376) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001376) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001376) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001376) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001376) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001376) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001376) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001376) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007336) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007336) "Melty.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateWindowStationW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter BuildTrusteeWithSidW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegisterSuspendResumeNotification (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter UnmapViewOfFile2 (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetCurrentProcessExplicitAppUserModelID (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter BuildExplicitAccessWithNameW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter BuildSecurityDescriptorW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter AccProvGetCapabilities (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetPointerDevices (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetDisplayConfigBufferSizes (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter QueryDisplayConfig (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DisplayConfigGetDeviceInfo (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegisterDeviceNotificationW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetICMProfileW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DwmSetWindowAttribute (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsZoomed (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMetricsForDpi (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetPropW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegisterPointerDeviceNotifications (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetMenuItemInfoW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsRectEmpty (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateIconIndirect (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CopyIcon (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RegisterPowerSettingNotification (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowRgn (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DwmGetWindowAttribute (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetClassLongPtrW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsWindowArranged (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateRectRgnIndirect (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CombineRgn (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetWindowDisplayAffinity (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter Shell_NotifyIconW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetCurrentProcessExplicitAppUserModelID (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetClassInfoExW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter AtlThunk_AllocateData (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter AtlThunk_InitData (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter AtlThunk_DataToCode (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter AtlThunk_FreeData (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CreateStdAccessibleObject (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetInputScope (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetMessageTime (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DiscardVirtualMemory (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RemovePropW (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter SetParent (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter ToUnicodeEx (UID: 00000000-00002428) "Melty.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetNamedPipeClientProcessId (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter RtlGetUnloadEventTraceEx (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter CallNtPowerInformation (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00003472) "Melty.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00003472) "reg.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000860) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000860) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000860) "reg.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000860) "reg.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000860) "reg.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000860) "Melty.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CreateWindowStationW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter BuildTrusteeWithSidW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00007460) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00007460) "reg.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007380) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007380) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007380) "reg.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007380) "reg.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007380) "reg.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007380) "windows-inspector.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003344) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003344) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003344) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003344) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003344) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003344) "windows-inspector.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003344) "windows-inspector.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000684) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000684) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000684) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000684) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000684) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000684) "Melty.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter UnmapViewOfFile2 (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter SetCurrentProcessExplicitAppUserModelID (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter av_get_cpu_flags (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter av_log_set_level (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter av_max_alloc (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter DWriteCoreCreateFactory (UID: 00000000-00002316) "Melty.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00002316) "windows-inspector.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007352) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007352) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007352) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007352) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007352) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007352) "windows-inspector.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007352) "windows-inspector.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007632) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007632) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007632) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007632) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007632) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007632) "Melty.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter UnmapViewOfFile2 (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter SetCurrentProcessExplicitAppUserModelID (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter av_get_cpu_flags (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter av_log_set_level (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter av_max_alloc (UID: 00000000-00001076) "Melty.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter UnmapViewOfFile2 (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter SetCurrentProcessExplicitAppUserModelID (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter av_get_cpu_flags (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter av_log_set_level (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter av_max_alloc (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00008000) "Melty.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter UnmapViewOfFile2 (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter SetCurrentProcessExplicitAppUserModelID (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter av_get_cpu_flags (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter av_log_set_level (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter av_max_alloc (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00006708) "Melty.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00006708) "windows-inspector.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007816) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007816) "windows-inspector.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007816) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007816) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007816) "windows-inspector.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007816)3a:T9187,Found reference to API (Indicator: "MulDiv"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "FindClose"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "ReadFile"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "lstrlenA"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GlobalFree"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "lstrcmpW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CloseHandle"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetFileTime"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SearchPathW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "MoveFileW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "Sleep"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetTickCount"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetFileSize"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CopyFileW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "ExitProcess"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetTempPathW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetVersion"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "lstrlenW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "lstrcpynW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GlobalLock"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CreateThread"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetLastError"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CreateFileW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "WriteFile"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "lstrcpyA"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "MoveFileExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "lstrcatW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "FillRect"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetClientRect"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "BeginPaint"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "EnableWindow"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "ReleaseDC"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetDC"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "LoadImageW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "IsWindow"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "wsprintfW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "ShowWindow"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetTimer"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CharNextW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegisterClassW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetSysColor"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetCursor"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "LoadCursorW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "AppendMenuW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CharPrevW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CharNextA"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "wsprintfA"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "PeekMessageW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SelectObject"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "DeleteObject"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetFileSecurityW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "OleInitialize"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Melty-Setup-1.0.72.exe") Found reference to API (Indicator: "WinStationFreeMemory"; File: "00000000-00007336.00000000.121192.00EB1000.00000020.mdmp") Found reference to API (Indicator: "WinStationCloseServer"; File: "00000000-00007336.00000000.121192.00EB1000.00000020.mdmp") Found reference to API (Indicator: "WinStationOpenServerW"; File: "00000000-00007336.00000000.121192.00EB1000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; File: "00000000-00007336.00000000.121192.00EB1000.00000020.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegRestoreKeyW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyExW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "NtQueryKey"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "FindStringOrdinal"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000860.00000000.123483.F5790000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001076.00000000.126256.F9E30000.00000004.mdmp, 00000000-00001076.00000001.127149.F9E30000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001076.00000000.126256.F9E30000.00000004.mdmp, 00000000-00001076.00000001.127149.F9E30000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00001076.00000000.126256.F9E30000.00000004.mdmp, 00000000-00001076.00000001.127149.F9E30000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "HeapQueryInformation"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002316.00000000.124337.599BA000.00000002.mdmp")3b:T4d9,"Software\Microsoft\Windows\CurrentVersion" in Source: Melty-Setup-1.0.72.exe "reg.exe DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize /v StartupDelayInMSec /f" in Source: 00000000-00002428-00000C47-24840162408 "reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v gg.melty.desktop /t REG_SZ /d "\"%LOCALAPPDATA%\" in Source: 00000000-00002428-00000C47-37720718670 "DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize /v StartupDelayInMSec /f" in Source: reg.exe "ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v gg.melty.desktop /t REG_SZ /d "\"%LOCALAPPDATA%\Programs\melty\Melty.exe\" --melty-startup" /f" in Source: reg.exe "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000860.00000000.123483.F5790000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00000860.00000000.123483.F5790000.00000002.mdmp "reg.exe DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize /v StartupDelayInMSec /f" in Source: 00000000-00000860.00000000.123483.F5F50000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" in Source: 00000000-00000860.00000000.123483.F5F50000.00000004.mdmp3c:T930,Process Melty-Setup-1.0.72.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7784:168:WilStaging_02" Process Melty-Setup-1.0.72.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7784:168:WilStaging_02" Process Melty-Setup-1.0.72.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7784:64:WilError_03" Process Melty-Setup-1.0.72.exe created mutex with name "\Sessions\1\BaseNamedObjects\cbd704c5-5a32-5f56-b24f-e3be5a61d42a" Process Melty-Setup-1.0.72.exe created mutex with name "Local\SM0:7784:168:WilStaging_02" Process Melty-Setup-1.0.72.exe created mutex with name "SM0:7784:168:WilStaging_02" Process Melty-Setup-1.0.72.exe created mutex with name "SM0:7784:64:WilError_03" Process Melty-Setup-1.0.72.exe created mutex with name "cbd704c5-5a32-5f56-b24f-e3be5a61d42a" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1376:168:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1376:168:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:1376:168:WilStaging_02" Process cmd.exe created mutex with name "SM0:1376:168:WilStaging_02" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7336:168:WilStaging_02" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7336:168:WilStaging_02" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7336:64:WilError_03" Process tasklist.exe created mutex with name "Local\SM0:7336:168:WilStaging_02" Process tasklist.exe created mutex with name "SM0:7336:64:WilError_03" Process tasklist.exe created mutex with name "SM0:7336:168:WilStaging_02" Process find.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5216:168:WilStaging_02" Process find.exe created mutex with name "SM0:5216:168:WilStaging_02" Process Melty.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2428:304:WilStaging_02" Process Melty.exe created mutex with name "Local\SM0:2428:304:WilStaging_02" Process Melty.exe created mutex with name "SM0:2428:304:WilStaging_02" Process Melty.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2428:304:WilStaging_02" Process Melty.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex"3d:T43b,Found string - \\.\pipe\crashpad_2428_ZHPTIQIOVKJWBTIC Found string - \\.\pipe\LOCAL\mojo.2428.2152.11793255520657720437 Found string - \\.\pipe\LOCAL\mojo.2428.2152.15443884749622196807 Found string - \\.\pipe\LOCAL\mojo.2428.2152.2277927532155863993 Found string - \\.\pipe\LOCAL\mojo.2428.2152.3325140428274133809 Found string - \\.\pipe\LOCAL\mojo.2428.2188.7686672374416919278 Found string - \\.\pipe\LOCAL\mojo.2428.2152.18190850081995498922 Found string - \\.\pipe\LOCAL\mojo.2428.2152.13741945480792406311 Found string - \\.\pipe\LOCAL\mojo.2428.2152.6653763191353671402 Found string - \\.\pipe\LOCAL\mojo.2428.2152.12321210476814581940 Found string - \\.\pipe\LOCAL\mojo.2428.2152.16074147979578174907 Found string - \\.\pipe\LOCAL\mojo.2428.2188.15402197639561615280 Found string - \\.\pipe\LOCAL\mojo.2428.2152.1075358610796436847 Found string - \\.\pipe\LOCAL\mojo.2428.2152.15571487125327032862 Found string - CHROME_CRASHPAD_PIPE_NAME=\\.\pipe\crashpad_2428_ZHPTIQIOVKJWBTIC Found string - HROME_CRASHPAD_PIPE_NAME=\\.\pipe\crashpad_2428_ZHPTIQIOVKJWBTIC3e:T377f,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000860.00000000.123483.F5790000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00000860.00000000.123483.F5790000.00000002.mdmp "reg.exe DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize /v StartupDelayInMSec /f" in Source: 00000000-00000860.00000000.123483.F5F50000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" in Source: 00000000-00000860.00000000.123483.F5F50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002428.00000001.124704.76290000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00002428.00000001.124704.76290000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0Z" in Source: 00000000-00002428.00000001.124704.76290000.00000004.mdmp "e\Software\C" in Source: 00000000-00002428.00000001.124704.76290000.00000004.mdmp "7874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0a" in Source: 00000000-00002428.00000001.124704.76290000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00002428.00000001.124704.76290000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00002428.00000001.124704.E9D50000.00000004.mdmp "S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{D" in Source: 00000000-00002428.00000001.124704.E9D50000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{A" in Source: 00000000-00002428.00000001.124704.E9D50000.00000004.mdmp "Registry\Machine\OSDATA\Software\Microsoft\#" in Source: 00000000-00002428.00000001.124704.E9D50000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0Z" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "e\Software\C" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "7874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0a" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Melty.exe" in Source: 00000000-00002428.00000002.126627.76290000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows-inspector.exe" in Source: 00000000-00002428.00000002.126627.E9D50000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00002428.00000002.126627.E9D50000.00000004.mdmp "S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{D" in Source: 00000000-00002428.00000002.126627.E9D50000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}" in Source: 00000000-00002428.00000002.126627.E9D50000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{54E211B6-3650-4F75-8334-FA359598E1C5}" in Source: 00000000-00002428.00000002.126627.E9D50000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{A" in Source: 00000000-00002428.00000002.126627.E9D50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002428.00000003.128691.76290000.00000004.mdmp "87874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002428.00000003.128691.76290000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00002428.00000003.128691.76290000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0Z" in Source: 00000000-00002428.00000003.128691.76290000.00000004.mdmp "e\Software\C" in Source: 00000000-00002428.00000003.128691.76290000.00000004.mdmp "7874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0a" in Source: 00000000-00002428.00000003.128691.76290000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Melty.exe" in Source: 00000000-00002428.00000003.128691.76290000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows-inspector.exe" in Source: 00000000-00002428.00000003.128691.E9D50000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00002428.00000003.128691.E9D50000.00000004.mdmp "S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{D" in Source: 00000000-00002428.00000003.128691.E9D50000.00000004.mdmp "Y\MACHINE\Software\Rockstar Games" in Source: 00000000-00003344.00000000.123888.38870000.00000004.mdmp "448-3812392235-1001\Software\Rockstar Games" in Source: 00000000-00003344.00000000.123888.38870000.00000004.mdmp "\REGISTRY\MACHINE\Software\Rockstar Games" in Source: 00000000-00003344.00000000.123888.38870000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Rockstar Games" in Source: 00000000-00003344.00000000.123888.38870000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "Path=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;%NVM_HOME%;%NVM_SYMLINK%;C:\Users\HAPUBWS\A\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "USERDOMAIN_ROAMINGP\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "\Software\Classes\WOW6432Node\CLSID\{0X" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\Microsoft.Windows.ParentalControls_c" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0s" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\ResourcesConfig" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\ResourceQualifiers" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0{" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0{" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{9{" in Source: 00000000-00003344.00000001.124765.38870000.00000004.mdmp "chine\Software\Classes\CLSID\{00{" in Source: 00000000-00003344.00000001.124765.3AB90000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003344.00000001.124765.3AB90000.00000004.mdmp "74-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003344.00000001.124765.3AB90000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003344.00000001.124765.3AB90000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0{" in Source: 00000000-00003344.00000001.124765.3AB90000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0z" in Source: 00000000-00003344.00000001.124765.3AB90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0{" in Source: 00000000-00003344.00000001.124765.3AB90000.00000004.mdmp "74-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003344.00000001.124765.3AC2A000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003344.00000001.124765.AEE82000.00000002.mdmp "Software\Valve\Steam" in Source: 00000000-00003344.00000001.124765.AEE82000.00000002.mdmp "Software\Rockstar Games" in Source: 00000000-00003344.00000001.124765.AEE82000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00003472.00000002.127101.538E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Melty.exe" in Source: 00000000-00003472.00000003.128721.538E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00003472.00000003.128721.538E0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00007336.00000000.121192.73C01000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00007336.00000000.121192.73C01000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00007336.00000000.121192.73C01000.00000020.mdmp "\REGISTRY\MACHINE\Software\Valve\Steam" in Source: 00000000-00007352.00000000.125113.E3B30000.00000004.mdmp "232448-3812392235-1001\Software\Valve\Steam" in Source: 00000000-00007352.00000000.125113.E3B30000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Valve\Steam" in Source: 00000000-00007352.00000000.125113.E3B30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Valve\Steam" in Source: 00000000-00007352.00000001.127031.E3B30000.00000004.mdmp "232448-3812392235-1001\Software\Valve\Steam" in Source: 00000000-00007352.00000001.127031.E3B30000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Valve\Steam" in Source: 00000000-00007352.00000001.127031.E3B30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Valve\Steam" in Source: 00000000-00007352.00000002.128704.E3B30000.00000004.mdmp "232448-3812392235-1001\Software\Valve\Steam" in Source: 00000000-00007352.00000002.128704.E3B30000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Valve\Steam" in Source: 00000000-00007352.00000002.128704.E3B30000.00000004.mdmp "reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v gg.melty.desktop /t REG_SZ /d "\"C:\Users\cZw4133\AppData\Local\Programs\melty\Melty.exe\" --melty-startup" /f" in Source: 00000000-00007380.00000000.123826.6BF00000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007380.00000000.123826.6BF00000.00000004.mdmp "S-1-5-21-1271187874-\Registry\Machine\Software\Clas" in Source: 00000000-00007460.00000000.123807.541D0000.00000004.mdmp "y\Machine\Software\Classes\C" in Source: 00000000-00007460.00000000.123807.541D0000.00000004.mdmp "874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007460.00000000.123807.541D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007784.00000000.120940.0041E000.00000004.mdmp "Software\cbd704c5-5a32-5f56-b24f-e3be5a61d42a" in Source: 00000000-00007784.00000000.120940.008A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\cbd704c5-5a32-5f56-b24f-e3be5a61d42a" in Source: 00000000-00007784.00000000.120940.008A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007784.00000000.120940.741C4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007784.00000001.122562.00408000.00000002.mdmp "Software\cbd704c5-5a32-5f56-b24f-e3be5a61d42a" in Source: 00000000-00007784.00000001.122562.008A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\cbd704c5-5a32-5f56-b24f-e3be5a61d42a" in Source: 00000000-00007784.00000001.122562.008A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007784.00000001.122562.008A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007784.00000001.122562.02FCF000.00000004.mdmp "stry\Machine\Software\Classes\Interface\{A4C6892C-3BA9-11D2-9DEA-00C04FB16162}\ProxyStubClsid32" in Source: 00000000-00007784.00000001.122562.02FEB000.00000004.mdmp3f:T3a92,"Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74cd0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74f60000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 74fe0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 774f0000 "Melty-Setup-1.0.72.exe" loaded module "NTDLL.DLL" at base 77a60000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74e60000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74c00000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 74bd0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74bc0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 74b60000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75830000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 74f10000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75750000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 74b50000 "Melty-Setup-1.0.72.exe" loaded module "KERNEL32.DLL" at base 758c0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 74360000 "Melty-Setup-1.0.72.exe" loaded module "%TEMP%\NSNC9A2.TMP\SYSTEM.DLL" at base 741f0000 "Melty-Setup-1.0.72.exe" loaded module "%TEMP%\NSNC9A2.TMP\STDUTILS.DLL" at base 741b0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 74130000 "Melty-Setup-1.0.72.exe" loaded module "COMCTL32.DLL" at base 754e0000 "Melty-Setup-1.0.72.exe" loaded module "RPCRT4.DLL" at base 771e0000 "Melty-Setup-1.0.72.exe" loaded module "%TEMP%\NSNC9A2.TMP\SPIDERBANNER.DLL" at base 73f40000 "Melty-Setup-1.0.72.exe" loaded module "PSAPI" at base 765d0000 "Melty-Setup-1.0.72.exe" loaded module "%TEMP%\NSNC9A2.TMP\NSEXEC.DLL" at base 73f30000 "Melty-Setup-1.0.72.exe" loaded module "KERNELBASE" at base 76350000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77410000 "Melty-Setup-1.0.72.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76950000 "Melty-Setup-1.0.72.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76780000 "Melty-Setup-1.0.72.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76780000 "Melty-Setup-1.0.72.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76f80000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76e30000 "Melty-Setup-1.0.72.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76350000 "Melty-Setup-1.0.72.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76350000 "Melty-Setup-1.0.72.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76350000 "Melty-Setup-1.0.72.exe" loaded module "KERNEL32" at base 758c0000 "Melty-Setup-1.0.72.exe" loaded module "%TEMP%\NSNC9A2.TMP\NSIS7Z.DLL" at base 73ec0000 "Melty-Setup-1.0.72.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74f40000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74480000 "Melty-Setup-1.0.72.exe" loaded module "SHELL32.DLL" at base 75c50000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 73e50000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73d60000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 743b0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.FILEEXPLORER.COMMON.DLL" at base 73cb0000 "Melty-Setup-1.0.72.exe" loaded module "COMBASE.DLL" at base 76ba0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75c50000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSTEM32\NTSHRUI.DLL" at base 73c30000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74480000 "Melty-Setup-1.0.72.exe" loaded module "CSCAPI.DLL" at base 73bc0000 "Melty-Setup-1.0.72.exe" loaded module "%TEMP%\NSNC9A2.TMP\WINSHELL.DLL" at base 10000000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 770a0000 "Melty-Setup-1.0.72.exe" loaded module "OLEAUT32" at base 770a0000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 73780000 "Melty-Setup-1.0.72.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73500000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74cd0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 758c0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77a60000 "cmd.exe" loaded module "KERNELBASE" at base 76350000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74f40000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74cd0000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 771e0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76350000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73e40000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 73d80000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73d60000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73c90000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76350000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76350000 "tasklist.exe" loaded module "AMSI.DLL" at base 73c70000 "tasklist.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76350000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76350000 "tasklist.exe" loaded module "KERNEL32" at base 758c0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75750000 "tasklist.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 73c00000 "tasklist.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76350000 "tasklist.exe" loaded module "%WINDIR%\SYSWOW64\YRAWIE6B.DLL" at base 73bc0000 "Melty.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff971500000 "Melty.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff980c30000 "Melty.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff980c30000 "Melty.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff980c30000 "Melty.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff981050000 "Melty.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff980c30000 "Melty.exe" loaded module "KERNEL32" at base 7ff982ea0000 "Melty.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff980c30000 "Melty.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff980c30000 "Melty.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff980c30000 "Melty.exe" loaded module "POWRPROF.DLL" at base 7ff980780000 "Melty.exe" loaded module "USER32.DLL" at base 7ff982380000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff97dee0000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff97fd70000 "Melty.exe" loaded module "SHELL32.DLL" at base 7ff981290000 "Melty.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 2c278420000 "Melty.exe" loaded module "ADVAPI32.DLL" at base 7ff982c90000 "Melty.exe" loaded module "KBDUS.DLL" at base 7ff971730000 "Melty.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff982670000 "Melty.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 2c278420000 "Melty.exe" loaded module "OLE32.DLL" at base 7ff982a00000 "Melty.exe" loaded module "OLEAUT32.DLL" at base 7ff9830f0000 "Melty.exe" loaded module "KERNEL32.DLL" at base 7ff982ea0000 "Melty.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff97f900000 "Melty.exe" loaded module "NTDLL.DLL" at base 7ff983490000 "Melty.exe" loaded module "GDI32.DLL" at base 7ff9830a0000 "Melty.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff982670000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ff9706c0000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.IMMERSIVE.DLL" at base 7ff96eb80000 "Melty.exe" loaded module "BCRYPTPRIMITIVES" at base 7ff981050000 "Melty.exe" loaded module "RPCRT4.DLL" at base 7ff983330000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 7ff97f920000 "Melty.exe" loaded module "NTMARTA.DLL" at base 7ff97f920000 "Melty.exe" loaded module "KERNELBASE" at base 7ff980c30000 "Melty.exe" loaded module "COMCTL32.DLL" at base 7ff96ae60000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ff972530000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff982f80000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff982a00000 "Melty.exe" loaded module "WTSAPI32.DLL" at base 7ff979820000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ff978470000 "Melty.exe" loaded module "CFGMGR32.DLL" at base 7ff9804b0000 "Melty.exe" loaded module "MSCMS.DLL" at base 7ff979460000 "Melty.exe" loaded module "SHLWAPI.DLL" at base 7ff982c30000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\MSSPELLCHECKINGFACILITY.DLL" at base 7ff95c340000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff9798a0000 "Melty.exe" loaded module "API-MS-WIN-POWER-BASE-L1-1-0.DLL" at base 7ff980780000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff97f870000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ff97bf00000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ff978890000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ff978f40000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\INPUTHOST.DLL" at base 7ff96e850000 "Melty.exe" loaded module "DWMAPI.DLL" at base 7ff97e2f0000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ff966680000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 7ff96e630000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7ff9678c0000 "Melty.exe" loaded module "ATLTHUNK.DLL" at base 7ff963810000 "Melty.exe" loaded module "OLEACC.DLL" at base 7ff966760000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ff96db70000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff97dd40000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7ff97e2f0000 "Melty.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ff9831d0000 "Melty.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff982380000 "Melty.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff982380000 "Melty.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ff982c90000 "Melty.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 25555920000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff971500000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ff982ea0000 "reg.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff97f900000 "Melty.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 2d7561a0000 "Melty.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff977ea0000 "Melty.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ff980c30000 "windows-inspector.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff971500000 "windows-inspector.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff980c30000 "windows-inspector.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff980c30000 "windows-inspector.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff980c30000 "windows-inspector.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff980c30000 "windows-inspector.exe" loaded module "KERNEL32" at base 7ff982ea0000 "windows-inspector.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff980c30000 "windows-inspector.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff980c30000 "windows-inspector.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff980c30000 "windows-inspector.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff97f900000 "windows-inspector.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 7ff981170000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\APPXDEPLOYMENTCLIENT.DLL" at base 7ff977660000 "windows-inspector.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff982670000 "windows-inspector.exe" loaded module "RPCRT4.DLL" at base 7ff983330000 "windows-inspector.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff980c30000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff97e8b0000 "windows-inspector.exe" loaded module "KERNEL32.DLL" at base 7ff982ea0000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.APPLICATIONMODEL.DLL" at base 7ff969a10000 "windows-inspector.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ff97f900000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff97a430000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff97dee0000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff96c810000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STATEREPOSITORYBROKER.DLL" at base 7ff9714d0000 "windows-inspector.exe" loaded module "USER32.DLL" at base 7ff982380000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ff9706c0000 "windows-inspector.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 7ff977210000 "windows-inspector.exe" loaded module "APPXDEPLOYMENTCLIENT.DLL" at base 7ff977660000 "windows-inspector.exe" loaded module "EXT-MS-ONECORE-APPMODEL-STATEREPOSITORY-CACHE-L1-1-0.DLL" at base 7ff9771f0000 "Melty.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 1a4bb870000 "Melty.exe" loaded module "DWRITE.DLL" at base 7ff97c8f0000 "Melty.exe" loaded module "FFMPEG.DLL" at base 7ff959760000 "Melty.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 1f5fbde0000 "Melty.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 2864d2b0000 "Melty.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 1e18a34000040:T16a8,"Melty-Setup-1.0.72.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}") "Melty-Setup-1.0.72.exe" touched "ShellWindows" (Path: "HKCU\WOW6432NODE\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\TREATAS") "Melty-Setup-1.0.72.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "Melty-Setup-1.0.72.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "Melty-Setup-1.0.72.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "Melty-Setup-1.0.72.exe" touched "Recycle Bin Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4A04656D-52AA-49DE-8A09-CB178760E748}\INSTANCE") "Melty-Setup-1.0.72.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Melty-Setup-1.0.72.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Melty-Setup-1.0.72.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Melty-Setup-1.0.72.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "Melty-Setup-1.0.72.exe" touched "Shell Copy Hook" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\INPROCSERVER32") "Melty-Setup-1.0.72.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\INSTANCE") "Melty-Setup-1.0.72.exe" touched "IPropertyStore Handler for Images" (Path: "HKCU\WOW6432NODE\CLSID\{A38B883C-1682-497E-97B0-0A3A9E801682}\OVERRIDEFILESYSTEMPROPERTIES") "Melty-Setup-1.0.72.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Melty-Setup-1.0.72.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "Melty-Setup-1.0.72.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "Melty-Setup-1.0.72.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "Melty-Setup-1.0.72.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Melty-Setup-1.0.72.exe" touched "Property Store over folder final" (Path: "HKCU\WOW6432NODE\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "Melty-Setup-1.0.72.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Melty-Setup-1.0.72.exe" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "tasklist.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Melty.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}") "Melty.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "Melty.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "Melty.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "Melty.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "Melty.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "Melty.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "Melty.exe" touched "Microsoft Spell Checker Factory Class" (Path: "HKCU\CLSID\{7AB36653-1796-484B-BDFA-E74F1DB7C1DC}\TREATAS") "windows-inspector.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "windows-inspector.exe" touched "Windows Search Manager" (Path: "HKCU\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\TREATAS") "windows-inspector.exe" touched "Property System Apartment Class Factory" (Path: "HKCU\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\TREATAS") "windows-inspector.exe" touched "@%SystemRoot%\system32\shell32.dll,-22067" (Path: "HKCU\CLSID\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\SHELLFOLDER") "windows-inspector.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "windows-inspector.exe" touched "Run..." (Path: "HKCU\CLSID\{2559A1F3-21D7-11D4-BDAF-00C04F60B9F0}\SHELLFOLDER")41:T73b,Observed system executable string:"\Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe" [Source: 00000000-00007784-00000BC0-885579150] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00007784-00000BC0-885581611] Observed system executable string:""%WINDIR%\system32\cmd.exe" /s /c ""%WINDIR%\system32\tasklist.exe" /FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq Melty.exe" /FO" [Source: 00000000-00007784-00000C47-6515054782], Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00001376-00000BC0-885739508], Observed system executable string:"\Device\HarddiskVolume3\Windows\SysWOW64\tasklist.exe" [Source: 00000000-00001376-00000BC0-886396451], Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00001376-00000BC0-886399637], Observed system executable string:"\Device\HarddiskVolume3\Windows\SysWOW64\find.exe" [Source: 00000000-00001376-00000BC0-886456773], Observed system executable string:"%WINDIR%\system32\find.exe" [Source: 00000000-00001376-00000BC0-886458538], Observed system executable string:""%WINDIR%\system32\tasklist.exe" /FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq Melty.exe" /FO csv" [Source: 00000000-00001376-00000C47-1054476334], Observed system executable string:""%WINDIR%\system32\find.exe" /I "Melty.exe"" [Source: 00000000-00001376-00000C47-1196300904], Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\reg.exe" [Source: 00000000-00002428-00000BC0-922126494], Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00002428-00000BC0-922127212], Observed system executable string:"/s /c ""%WINDIR%\system32\tasklist.exe" /FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq Melty.exe" /FO csv | "%WINDIR%\system32\find.exe" /I "Melty.exe""" [Source: cmd.exe]42:T7be,Process "cmd.exe" (UID: 00000000-00001376) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N", PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00001376) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "tasklist.exe" (UID: 00000000-00007336) was launched with new environment variables: "PROMPT="$P$G"" Process "Melty.exe" (UID: 00000000-00002428) was launched with new environment variables: "EFC_5268="1"" Process "Melty.exe" (UID: 00000000-00002428) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "Melty.exe" (UID: 00000000-00002428) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432" Process "Melty.exe" (UID: 00000000-00003472) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "reg.exe" (UID: 00000000-00000860) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2428_ZHPTIQIOVKJWBTIC"" Process "reg.exe" (UID: 00000000-00000860) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "Melty.exe" (UID: 00000000-00007416) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "reg.exe" (UID: 00000000-00007380) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "Melty.exe" (UID: 00000000-00002316) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "windows-inspector.exe" (UID: 00000000-00007352) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "Melty.exe" (UID: 00000000-00006332) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "Melty.exe" (UID: 00000000-00004160) was launched with modified environment variables: "NUMBER_OF_PROCESSORS"43:T760,"Melty-Setup-1.0.72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Melty-Setup-1.0.72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Melty-Setup-1.0.72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Melty.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Melty.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Melty.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "Melty.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "Melty.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "Melty.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "Melty.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "Melty.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "Melty.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA-DK") "Melty.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA-DK")44:T720,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00007784-00000C2B-883251678] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00007784-00000C2B-883272674] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00007784-00000C2B-883303859] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00007784-00000C2B-883466008] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00007784-00000C2B-883490148] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00007784-00000C2B-883510455] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00007784-00000C2B-883529163] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00007784-00000C2B-883550091] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00007784-00000C2B-883569820] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00007784-00000C2B-883589602] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00007784-00000C2B-883608537] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00007784-00000C2B-883627967] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00007784-00000C2B-884713255] Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00007336-00000C2B-887366657] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007336-00000C2B-887920695] Observed system executable string:"%WINDIR%\system32\ntmarta.dll" [Source: 00000000-00002428-00000C2B-913320705]45:Tb5a,Spawned process "cmd.exe" with commandline "/s /c ""%WINDIR%\\system32\\tasklist.exe" /FI "USERNAME eq %OSUS ..." (UID: 00000000-00001376) Spawned process "tasklist.exe" with commandline "/FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq Melty.exe" /FO csv" (UID: 00000000-00007336) Spawned process "find.exe" with commandline "/I "Melty.exe"" (UID: 00000000-00005216) Spawned process "Melty.exe" (UID: 00000000-00002428) Spawned process "Melty.exe" with commandline "%APPDATA%\\Melty /prefetch:4 --no-rate-limit --monitor-self-anno ..." (UID: 00000000-00003472) Spawned process "reg.exe" with commandline "DELETE HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explo ..." (UID: 00000000-00000860) Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00007416) Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --secure-schemes=sentry-ipc --bypasscsp-schem ..." (UID: 00000000-00007460) Spawned process "reg.exe" with commandline "ADD HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v g ..." (UID: 00000000-00007380) Spawned process "windows-inspector.exe" with commandline "--generation 1" (UID: 00000000-00003344) Spawned process "windows-inspector.exe" with commandline "--process-names" (UID: 00000000-00000684) Spawned process "Melty.exe" with commandline "--type=renderer --user-data-dir="C:\\Users\\cZw4133\\AppData\\Ro ..." (UID: 00000000-00002316), Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00007740), Spawned process "windows-inspector.exe" with commandline "--generation 2" (UID: 00000000-00007352), Spawned process "windows-inspector.exe" with commandline "--process-names" (UID: 00000000-00007632), Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00006332), Spawned process "Melty.exe" with commandline "--type=renderer --user-data-dir="C:\\Users\\cZw4133\\AppData\\Ro ..." (UID: 00000000-00001076) Spawned process "Melty.exe" with commandline "--type=renderer --user-data-dir="C:\\Users\\cZw4133\\AppData\\Ro ..." (UID: 00000000-00008000), Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00004204), Spawned process "Melty.exe" with commandline "--type=renderer --user-data-dir="C:\\Users\\cZw4133\\AppData\\Ro ..." (UID: 00000000-00006708) Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00007376) Spawned process "windows-inspector.exe" with commandline "--process-names" (UID: 00000000-00007816) Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00004160)46:Tb5a,Spawned process "cmd.exe" with commandline "/s /c ""%WINDIR%\\system32\\tasklist.exe" /FI "USERNAME eq %OSUS ..." (UID: 00000000-00001376) Spawned process "tasklist.exe" with commandline "/FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq Melty.exe" /FO csv" (UID: 00000000-00007336) Spawned process "find.exe" with commandline "/I "Melty.exe"" (UID: 00000000-00005216) Spawned process "Melty.exe" (UID: 00000000-00002428) Spawned process "Melty.exe" with commandline "%APPDATA%\\Melty /prefetch:4 --no-rate-limit --monitor-self-anno ..." (UID: 00000000-00003472) Spawned process "reg.exe" with commandline "DELETE HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explo ..." (UID: 00000000-00000860) Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00007416) Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --secure-schemes=sentry-ipc --bypasscsp-schem ..." (UID: 00000000-00007460) Spawned process "reg.exe" with commandline "ADD HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v g ..." (UID: 00000000-00007380) Spawned process "windows-inspector.exe" with commandline "--generation 1" (UID: 00000000-00003344) Spawned process "windows-inspector.exe" with commandline "--process-names" (UID: 00000000-00000684) Spawned process "Melty.exe" with commandline "--type=renderer --user-data-dir="C:\\Users\\cZw4133\\AppData\\Ro ..." (UID: 00000000-00002316), Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00007740), Spawned process "windows-inspector.exe" with commandline "--generation 2" (UID: 00000000-00007352), Spawned process "windows-inspector.exe" with commandline "--process-names" (UID: 00000000-00007632), Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00006332), Spawned process "Melty.exe" with commandline "--type=renderer --user-data-dir="C:\\Users\\cZw4133\\AppData\\Ro ..." (UID: 00000000-00001076) Spawned process "Melty.exe" with commandline "--type=renderer --user-data-dir="C:\\Users\\cZw4133\\AppData\\Ro ..." (UID: 00000000-00008000), Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00004204), Spawned process "Melty.exe" with commandline "--type=renderer --user-data-dir="C:\\Users\\cZw4133\\AppData\\Ro ..." (UID: 00000000-00006708) Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00007376) Spawned process "windows-inspector.exe" with commandline "--process-names" (UID: 00000000-00007816) Spawned process "Melty.exe" with commandline ""%APPDATA%\\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAA ..." (UID: 00000000-00004160)47:T967,The input sample is signed with a certificate issued by "CN=YR2, O=Let's Encrypt, C=US" (SHA1: E3:E5:E3:8F:42:FD:16:20:BE:64:26:00:CB:67:8E:BC:00:B4:0D:11; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: 2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 56:C5:AF:75:75:DD:24:8C:51:37:06:E8:9D:27:EA:9C:03:8F:22:41; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=YR1, O=Let's Encrypt, C=US" (SHA1: 45:36:56:22:74:54:CD:25:AB:FC:E2:34:6A:38:80:1E:EF:D0:60:5B; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US" (SHA1: F4:00:42:E2:E5:F7:E8:EF:81:89:FE:D1:55:19:AE:CE:42:C3:BF:A2; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft ID Verified CS EOC CA 04, O=Microsoft Corporation, C=US" (SHA1: 77:79:58:B7:F9:D7:E7:52:14:3C:A7:60:C1:2A:96:76:77:4C:E5:4B; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US" (SHA1: 4F:D4:16:36:DC:2A:CD:FB:D5:A8:C4:71:18:6E:43:DF:7D:BF:B3:84; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US" (SHA1: 8E:75:0F:45:9D:AF:9A:79:D6:37:0D:B7:47:AD:22:26:86:6A:D8:18; see report for more information)48:T19de,"nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsnC9A2.tmp\nsis7z.dll]- [targetUID: 00000000-00007784] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsnC9A2.tmp\StdUtils.dll]- [targetUID: 00000000-00007784] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsnC9A2.tmp\System.dll]- [targetUID: 00000000-00007784] "SpiderBanner.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsnC9A2.tmp\SpiderBanner.dll]- [targetUID: 00000000-00007784] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsnC9A2.tmp\nsExec.dll]- [targetUID: 00000000-00007784] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\LICENSES.chromium.html]- [targetUID: 00000000-00007784] "app-64.7z" has type "7-zip archive data version 0.4"- Location: [%TEMP%\nsnC9A2.tmp\app-64.7z]- [targetUID: 00000000-00007784] "icudtl.dat" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\icudtl.dat]- [targetUID: 00000000-00002316] "ml.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\ml.pak]- [targetUID: 00000000-00007784] "kn.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\kn.pak]- [targetUID: 00000000-00007784] "hi.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\hi.pak]- [targetUID: 00000000-00007784] "bn.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\bn.pak]- [targetUID: 00000000-00007784] "gu.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\gu.pak]- [targetUID: 00000000-00007784] "mr.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\mr.pak]- [targetUID: 00000000-00007784] "el.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\el.pak]- [targetUID: 00000000-00007784] "ru.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\ru.pak]- [targetUID: 00000000-00007784] "bg.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\bg.pak]- [targetUID: 00000000-00007784] "ar.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\ar.pak]- [targetUID: 00000000-00007784] "fa.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\fa.pak]- [targetUID: 00000000-00007784] "am.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\am.pak]- [targetUID: 00000000-00007784] "he.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\he.pak]- [targetUID: 00000000-00007784] "ja.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\ja.pak]- [targetUID: 00000000-00007784] "lt.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\lt.pak]- [targetUID: 00000000-00007784] "lv.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\lv.pak]- [targetUID: 00000000-00007784] "hu.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\hu.pak]- [targetUID: 00000000-00007784] "fr.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\fr.pak]- [targetUID: 00000000-00007784] "sk.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\sk.pak]- [targetUID: 00000000-00007784] "cs.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\cs.pak]- [targetUID: 00000000-00007784] "pl.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\pl.pak]- [targetUID: 00000000-00007784] "fil.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\fil.pak]- [targetUID: 00000000-00007784] "ro.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\ro.pak]- [targetUID: 00000000-00007784] "sl.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\sl.pak]- [targetUID: 00000000-00007784] "de.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\de.pak]- [targetUID: 00000000-00007784] "ca.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\ca.pak]- [targetUID: 00000000-00007784] "ko.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\ko.pak]- [targetUID: 00000000-00007784] "hr.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\hr.pak]- [targetUID: 00000000-00007784] "es-419.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\es-419.pak]- [targetUID: 00000000-00007784] "es.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\es.pak]- [targetUID: 00000000-00007784] "pt-PT.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\pt-PT.pak]- [targetUID: 00000000-00007784] "pt-BR.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\pt-BR.pak]- [targetUID: 00000000-00007784] "it.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\it.pak]- [targetUID: 00000000-00007784] "sr.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\sr.pak]- [targetUID: 00000000-00007784] "da.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\da.pak]- [targetUID: 00000000-00007784] "ms.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\ms.pak]- [targetUID: 00000000-00007784] "nl.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\nl.pak]- [targetUID: 00000000-00007784] "fi.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\fi.pak]- [targetUID: 00000000-00007784] "et.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\et.pak]- [targetUID: 00000000-00007784] "nb.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\nb.pak]- [targetUID: 00000000-00007784] "af.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\af.pak]- [targetUID: 00000000-00007784] "id.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\id.pak]- [targetUID: 00000000-00007784] "en-US.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\en-US.pak]- [targetUID: 00000000-00002316] "en-GB.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\locales\en-GB.pak]- [targetUID: 00000000-00007784] "chrome_200_percent.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\chrome_200_percent.pak]- [targetUID: 00000000-00002316] "chrome_100_percent.pak" has type "data"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\chrome_100_percent.pak]- [targetUID: 00000000-00002316] "LICENSE.electron.txt" has type "ASCII text"- Location: [%TEMP%\nsnC9A2.tmp\7z-out\LICENSE.electron.txt]- [targetUID: 00000000-00007784]49:T87b,"Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}\"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}\"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}\"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCSERVER32"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCSERVER32"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER32"; Key: ""; Value: "")4a:T60d,"Melty-Setup-1.0.72.exe" queries basic process information of the "C:\Melty-Setup-1.0.72.exe" (UID: 7784) "cmd.exe" queries basic process information of the "C:\Windows\SysWOW64\cmd.exe" (UID: 1376) "cmd.exe" queries basic process information of the "C:\Windows\SysWOW64\tasklist.exe" (UID: 1376) "cmd.exe" queries basic process information of the "C:\Windows\SysWOW64\find.exe" (UID: 1376) "tasklist.exe" queries basic process information of the "C:\Windows\SysWOW64\tasklist.exe" (UID: 7336) "Melty.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Programs\melty\Melty.exe" (UID: 2428) "Melty.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe" (UID: 2428) "Melty.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Programs\melty\Melty.exe" (UID: 3472) "reg.exe" queries basic process information of the "C:\Windows\System32\reg.exe" (UID: 860) "Melty.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Programs\melty\Melty.exe" (UID: 7416) "Melty.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Programs\melty\Melty.exe" (UID: 7460) "reg.exe" queries basic process information of the "C:\Windows\System32\reg.exe" (UID: 7380) "windows-inspector.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe" (UID: 3344)4b:Tbaf,"Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "DATA"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "GENERATION"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "DATA"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "GENERATION"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "DATA"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "GENERATION"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\PROXYSTUBCLSID32"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: ""; Value: "") "Melty-Setup-1.0.72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")4c:T46b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect virtual environment Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware4d:T7fe,"Melty-Setup-1.0.72.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Melty-Setup-1.0.72.exe.Local\" "Melty-Setup-1.0.72.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\COMCTL32.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "Melty-Setup-1.0.72.exe" trying to touch file "C:\WINDOWS\SysWOW64\oleaut32.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\windows\temp\VxSSL32.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\FLTLIB.DLL" "Melty-Setup-1.0.72.exe" trying to touch file "C:\WINDOWS\SysWOW64\FLTLIB.DLL" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\MSVCP140.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\WINDOWS\SysWOW64\MSVCP140.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Windows\SysWOW64\msvcp140.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\VCRUNTIME140.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\WINDOWS\SysWOW64\VCRUNTIME140.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Windows\SysWOW64\vcruntime140.dll" "Melty-Setup-1.0.72.exe" trying to touch file "C:\Melty-Setup-1.0.72.exe" "Melty-Setup-1.0.72.exe" trying to touch file "\Global??\FltMgrMsg" "Melty-Setup-1.0.72.exe" trying to touch file "C:\CRYPTSP.DLL" "Melty-Setup-1.0.72.exe" trying to touch file "C:\WINDOWS\SysWOW64\CRYPTSP.DLL"4e:Tafd,"Melty-Setup-1.0.72.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Melty.lnk" "Melty-Setup-1.0.72.exe" trying to access LNK file "C:\Users\%OSUSER%\Desktop\Melty.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\Public\Desktop\Adobe Reader XI.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\Desktop\Melty.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\Public\Desktop\Google Chrome.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\Public\Desktop\Microsoft Edge.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\LiveCaptions.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\VoiceAccess.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Melty.lnk" "windows-inspector.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk" "windows-inspector.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Speech Recognition.lnk" "windows-inspector.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk" "windows-inspector.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk" "windows-inspector.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk" "windows-inspector.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Fax and Scan.lnk" "windows-inspector.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player Legacy.lnk"4f:T957,"Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\MSVCP140.dll" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsnC9A2.tmp\System.dll" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsnC9A2.tmp\StdUtils.dll" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsnC9A2.tmp\SpiderBanner.dll" "cmd.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll" "find.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\VERSION.dll" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\WINMM.dll" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\USERENV.dll" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\dhcpcsvc.DLL" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\Secur32.dll" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\IPHLPAPI.DLL" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\WINHTTP.dll" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\DWrite.dll" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\DPAPI.DLL" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\SSPICLI.DLL"50:T8f2,"Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\Melty-Setup-1.0.72.exe.Local\" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\PROPSYS.dll.mui" "Melty-Setup-1.0.72.exe" trying to access non-existent file "C:\desktop.ini" "cmd.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\cmd.exe.mui" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\melty\WINSPOOL.DRV" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Melty\Crashpad\settings.dat" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Melty\discord-presence.json" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Melty\Local State" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Melty\Preferences" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\Local Storage" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\Downloads" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\.ssh" "Melty.exe" trying to access non-existent file "C:\Users\%OSUSER%\.gnupg" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\Network" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\Cookies" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\Cookies-journal" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\Network Persistent State" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\TransportSecurity" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\Trust Tokens" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\Trust Tokens-journal" "Melty.exe" trying to access non-existent file "C:\Users\cZw4133\AppData\Roaming\Melty\Local Storage\leveldb\LOG"51:T62f,Found http requests in header "GET /discover?desktopVersion=1.0.72" Found http requests in header "GET /_next/static/chunks/0e544e8d5ugn1.css?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /_next/static/chunks/18b5tl9zs.r8w.css?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /_next/static/chunks/0gdhhighhkpi_.css?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /_next/static/chunks/0.g9k4uxk_abw.css?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /_next/static/chunks/0ok8l684x2pvr.css?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /_next/static/chunks/0onxo9fuwce97.css?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /_next/static/chunks/05gvw5uchkbxe.css?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /_next/static/chunks/0qsvmhew2c6k6.css?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /_next/static/media/83afe278b6a6bb3c-s.p.0q-301v4kxxnr.woff2?dpl=dpl_FyQbVphyDCKCNSiJnGAqGkMriMS2" Found http requests in header "GET /design/melty-preview/suisse-semibold.otf" Found http requests in header "GET /design/melty-preview/suisse-book.otf" Found http requests in header "GET /brand/melty-wordmark-white.png" Found http requests in header "GET /melty/latest.yml?noCache=1k4h5dran" Found http requests in header "POST /api/4511488177012736/envelope/?sentry_version=7&sentry_key=d12d780174145d4d4acb413c18e55236&sentry_client=sentry.javascript.electron%2F7.13.0"52:T14151,Observed string: "\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocKfRhKmrHRJTas21ipYCFALH7In-RdfFJ2d_75h8l5W3S5M4VU=s96-c\" \"joinedAt\":\"2026-10-07T19:23:35.788Z\"} \"games\":[{\"slug\":\"team-fortress-2\" \"name\":\"Team Fortress 2\" \"shortName\":\"Team Fortress 2\" \"steamAppId\":\"440\"} {\"slug\":\"custom-the-binding-of-isaac-rebirth\" \"name\":\"The Binding of Isaac: Rebirth\" \"shortName\":\"Rebirth\" \"steamAppId\":\"250900\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/65838eee-3389-46b6-b03b-3d7b1b54c950\" \"previewMedia\":[{\"url\":\"/api/mods/media/65838eee-3389-46b6-b03b-3d7b1b54c950\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.1.0\" \"status\":\"live\" \"gets\":69 \"installs\":64 \"publishedAt\":\"2026-10-07T20:50:05.144Z\" \"updatedAt\":\"2026-10-07T20:50:05.144Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"b52f27ba-8212-4046-ac90-218e9d1cde4e\" \"needs\":[{\"slug\":\"team-fortress-2\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":null}} {\"id\":\"57b3abbf-5819-4b4b-9b31-57acb21022d9\" \"slug\":\"lego-peak-wars-complete-saga\" \"title\":\"LEGO PEAK Wars: Complete Saga\" \"tagline\":\"Climb PEAK as any LEGO Star Wars: The Complete Saga character, with their moves, voices and music, from your own copy.\" \"creator\":{\"id\":\"797bebc1-bfdd-4182-b220-cabe932a1d35\" \"name\":\"Tiritatk\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocI-dmhfKnFmW0tcAaRcQvmgKCoXegQP4K8COX8Sc8SgFWTykV84Zw=s96-c\" \"joinedAt\":\"2026-10-05T18:12:06.144Z\"} \"games\":[{\"slug\":\"peak\" \"name\":\"PEAK\" \"shortName\":\"PEAK\" \"steamAppId\":\"3527290\"} {\"slug\":\"custom-lego-star-wars-the-complete-saga\" \"name\":\"Lego Star Wars: The Complete Saga\" \"shortName\":\"The Complete Saga\" \"steamAppId\":\"32440\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/d0fecab7-ddcd-4593-9601-272b98531047\" \"previewMedia\":[{\"url\":\"/api/mods/media/ea4b66c9-a2e0-4458-bb13-29c214be0fc9\" \"kind\":\"video\"} {\"url\":\"/api/mods/media/d0fecab7-ddcd-4593-9601-272b98531047\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/979b925d-5fe4-49f5-bb0c-deb8ba3e98f4\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/3c605209-e9f8-462f-871c-4c83e47e494f\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/a3a79a9f-0782-4690-84e1-c22513702bb0\" \"kind\":\"image\"}] \"madeBy\":\"Tiritatk\" \"version\":\"0.1.0\" \"status\":\"live\" \"gets\":5 \"installs\":4 \"publishedAt\":\"2026-10-09T15:32:05.548Z\" \"updatedAt\":\"2026-10-09T15:32:05.548Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"4809d22e-d393-4b64-8088-ae97e5019c0c\" \"needs\":[{\"slug\":\"peak\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":{\"maxPlayers\":null \"connects\":false}}} {\"id\":\"fa28eff8-7099-4cb5-8449-ea360b04952b\" \"slug\":\"seed-478868574082066804\" \"title\":\"Seed 478868574082066804\" \"tagline\":\"Walk the 2010 Herobrine world with today's Minecraft: Alpha terrain, Alpha look, Alpha recipes.\" \"creator\":{\"id\":\"2e99d10d-d9c3-4bc0-a390-69429b0028f0\" \"name\":\"Offline\" \"avatarUrl\":\"/api/mods/people/2e99d10d-d9c3-4bc0-a390-69429b0028f0/photo?v=7181d42fc8de\" \"joinedAt\":\"2026-10-07T18:15:49.627Z\"} \"games\":[{\"slug\":\"minecraft-java\" \"name\":\"Minecraft: Java Edition\" \"shortName\":\"Minecraft\" \"storeUrl\":\"https://www.minecraft.net/en-us/store/minecraft-java-bedrock-edition-pc\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/810509ad-f693-42ee-a920-db139dd6d9bd\" \"previewMedia\":[{\"url\":\"/api/mods/media/810509ad-f693-42ee-a920-db139dd6d9bd\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/fd375efa-afd9-4953-aed2-69989daeeb5a\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/36ddbff1-fefd-485f-9a6f-a34d0bb8b176\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/4789408a-e30b-4267-bc69-304d61349501\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/54a45ff6-8750-479b-acf5-01b758374e27\" \"kind\":\"image\"}] \"madeBy\":\"Aire\" \"version\":\"0.1.10\" \"status\":\"live\" \"gets\":68 \"installs\":65 \"publishedAt\":\"2026-10-07T21:37:35.190Z\" \"updatedAt\":\"2026-10-08T20:27:05.838Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"7bdb46b3-8cce-49c9-89a5-eab28c52cc5b\" \"needs\":[{\"slug\":\"minecraft-java\" \"provisioned\":true}] \"mode\":\"installed\" \"firstLaunch\":\"Sign in to your Microsoft account in Prism Launcher if it asks; it then downloads Minecraft 26.2, Fabric and Java by itself. The game opens straight into Herobrine World. Type /creative or /survival in chat to switch game mode. Replay Mod records every session; exporting a replay to video needs FFmpeg, which you install yourself.\" \"multiplayer\":null}} {\"id\":\"bc79506e-fb87-4269-a6e1-42b34cc82a67\" \"slug\":\"portal-gun-l4d2-2\" \"title\":\"portal gun l4d2\" \"tagline\":\"inspirado en portal2\" \"creator\":{\"id\":\"2e8ffc8a-20d3-495d-a6e3-38be960a74d1\" \"name\":\"Jaime Alonso\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocKBBDIRfq_6EfqsY3PC0HJ-mdeb2Df2EtkEJPxF1OkjQI_A_w=s96-c\" \"joinedAt\":\"2026-10-09T17:27:31.492Z\"} \"games\":[{\"slug\":\"left-4-dead-2\" \"name\":\"Left 4 Dead 2\" \"shortName\":\"Left 4 Dead 2\" \"steamAppId\":\"550\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":null \"previewMedia\":[] \"madeBy\":null \"version\":\"1.0.0\" \"status\":\"live\" \"gets\":3 \"installs\":2 \"publishedAt\":\"2026-10-09T18:18:05.852Z\" \"updatedAt\":\"2026-10-09T18:18:05.852Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"72c1e3fc-8e19-428f-9d17-3a0f2813547f\" \"needs\":[{\"slug\":\"left-4-dead-2\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":null}} {\"id\":\"edd79064-a7cd-4490-ac19-408819403e89\" \"slug\":\"the-sift\" \"title\":\"The Sift\" \"tagline\":\"Minecraft Dungeons II's Sift as a new dimension in Minecraft Java. Play the Singer's melody at an ancient city portal to get there.\" \"creator\":{\"id\":\"8a49318f-d248-49d3-a230-38e626f18f18\" \"name\":\"fewmet\" \"avatarUrl\":\"/api/mods/people/8a49318f-d248-49d3-a230-38e626f18f18/photo?v=bebc528eb1fd\" \"joinedAt\":\"2026-10-06T02:54:05.658Z\"} \"games\":[{\"slug\":\"minecraft-java\" \"name\":\"Minecraft: Java Edition\" \"shortName\":\"Minecraft\" \"storeUrl\":\"https://www.minecraft.net/en-us/store/minecraft-java-bedrock-edition-pc\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/38d1531a-6111-43a6-bd1a-e1ebdf2c14a8\" \"previewMedia\":[{\"url\":\"/api/mods/media/38d1531a-6111-43a6-bd1a-e1ebdf2c14a8\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/ebcc1bac-1c35-46fe-a15b-d2a31443713c\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/2f74d628-f576-40b4-8958-44acdeb0fd98\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/a7625a3b-fce6-4a35-9959-09aa318ef975\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/ed5ae2a8-c6fe-4be8-a2c2-931b0a3dab5a\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/64814146-da35-44a9-8f90-3ac0158ccf82\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.2.0\" \"status\":\"live\" \"gets\":111 \"installs\":104 \"publishedAt\":\"2026-10-06T19:27:55.244Z\" \"updatedAt\":\"2026-10-06T23:41:06.080Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"c7417b0f-8ffc-4b91-a3e3-88a043b087ba\" \"needs\":[{\"slug\":\"minecraft-java\" \"provisioned\":true}] \"mode\":\"installed\" \"firstLaunch\":\"Sign in to Prism Launcher with your Microsoft account the first time. To reach the Sift, play B flat, D sharp, G, G sharp, D, C sharp, E, A on note blocks by an ancient city's portal frame.\" \"multiplayer\":null}} {\"id\":\"ea7af7fb-c52c-479d-a7e7-cabd0ba535c7\" \"slug\":\"lethal-containment\" \"title\":\"Lethal Containment\" \"tagline\":\"Every moon's facility is SCP - Containment Breach: its rooms, SCP-173, 096, 106 and 049, keycards and the blink meter, from your own copy.\" \"creator\":{\"id\":\"7afab38e-529d-47d3-a271-48e81919663c\" \"name\":\"Beck\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocKq-Sc2ASkDZ7tzpqBi-amHBwa2plJvoQkspOmiduxK-ZkqnuM=s96-c\" \"joinedAt\":\"2026-10-09T03:35:27.576Z\"} \"games\":[{\"slug\":\"lethal-company\" \"name\":\"Lethal Company\" \"shortName\":\"Lethal Company\" \"steamAppId\":\"1966720\"} {\"slug\":\"custom-scp-containment-breach\" \"name\":\"SCP - Containment Breach\" \"shortName\":\"SCP - Containment Breach\" \"steamAppId\":\"3831680\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/208b5337-eb51-46c0-ae60-b4d52138131b\" \"previewMedia\":[{\"url\":\"/api/mods/media/208b5337-eb51-46c0-ae60-b4d52138131b\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/175643c3-1b0e-45ca-b197-4ea608d3f15c\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/6ff30e7f-0303-4842-97e5-b322ec8fc25b\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/bdfde11b-ddb8-4192-b30a-baa158708ad3\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/8328e4fb-bcb2-4dd9-9604-1ea6e74b9df2\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.1.1\" \"status\":\"live\" \"gets\":16 \"installs\":13 \"publishedAt\":\"2026-10-09T06:54:11.267Z\" \"updatedAt\":\"2026-10-09T07:25:40.240Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"cb21ad92-27e1-4bef-82e9-83dd0a20b59a\" \"needs\":[{\"slug\":\"lethal-company\"}] \"mode\":\"installed\" \"firstLaunch\":\"Host a game, land on any moon and go in through the main entrance: the facility inside is the Foundation site. Press B to blink on purpose. If SCP - Containment Breach is not installed, the game says so and plays as plain Lethal Company.\" \"multiplayer\":null}} {\"id\":\"799e359d-eddc-4e0d-8bd0-722f85785d27\" \"slug\":\"lords-of-the-island\" \"title\":\"Lords of the Island\" \"tagline\":\"Lords of the Fallen bosses roam the Sons of the Forest island. Hunt them, alone or with friends, for their weapons and Remembrances.\" \"creator\":{\"id\":\"0bc43549-469c-463f-9c4b-53affeca91c8\" \"name\":\"christopher lemelin\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocJW2VCFK6RpDYdX3nuU5f9eP7BAyfymodklBSEJC2miVNPo3Bk=s96-c\" \"joinedAt\":\"2026-10-09T12:29:17.905Z\"} \"games\":[{\"slug\":\"sons-of-the-forest\" \"name\":\"Sons of the Forest\" \"shortName\":\"Sons of the Forest\" \"steamAppId\":\"1326470\"} {\"slug\":\"custom-lords-of-the-fallen\" \"name\":\"Lords of the Fallen\" \"shortName\":\"Lords of the Fallen\" \"steamAppId\":\"1501750\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/4493f90f-d643-460a-8004-2df52251a8c1\" \"previewMedia\":[{\"url\":\"/api/mods/media/4493f90f-d643-460a-8004-2df52251a8c1\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"1.0.0\" \"status\":\"live\" \"gets\":2 \"installs\":2 \"publishedAt\":\"2026-10-09T18:20:06.048Z\" \"updatedAt\":\"2026-10-09T18:20:06.048Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"062ed572-45ec-451c-a4de-dc70f05a8eee\" \"needs\":[{\"slug\":\"sons-of-the-forest\"} {\"slug\":\"custom-lords-of-the-fallen\"}] \"mode\":\"installed\" \"firstLaunch\":\"The first Play takes about a minute longer while the bosses are prepared from your Lords of the Fallen install.\" \"multiplayer\":{\"maxPlayers\":8 \"connects\":false}}} {\"id\":\"85edaf1a-cdde-49ec-8272-010a70d2e1d0\" \"slug\":\"lego-marvel-heroes\" \"title\":\"LEGO Marvel Heroes\" \"tagline\":\"Play GMod sandbox as the real LEGO Marvel Iron Man, Hulk, Spider-Man and Thor: powers, studs, and falling apart into bricks.\" \"creator\":{\"id\":\"4843b3c5-4cea-4b2c-866b-9df06f543f22\" \"name\":\"Lex Wiaczek\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocLUL7EdER5cVMQC-3UIY50fQgwKcBf83FEWl0ez0yJTIUr5CmI=s96-c\" \"joinedAt\":\"2026-10-06T08:55:16.792Z\"} \"games\":[{\"slug\":\"garrys-mod\" \"name\":\"Garry's Mod\" \"shortName\":\"Garry's Mod\" \"steamAppId\":\"4000\"} {\"slug\":\"custom-lego-marvel-super-heroes\" \"name\":\"Lego Marvel Super Heroes\" \"shortName\":\"Lego Marvel Super Heroes\" \"steamAppId\":\"249130\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/4d09e6d8-1548-40c8-a6c3-47d76fd3c439\" \"previewMedia\":[{\"url\":\"/api/mods/media/4d09e6d8-1548-40c8-a6c3-47d76fd3c439\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/86cd90bd-e66c-4659-a28f-04117769c281\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/691d02c1-e7d2-4eed-9a78-3b643177d146\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/b59a4438-cb6e-40c8-aa1e-54aa34217022\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/4f0c0822-bfa6-4174-a781-23db7c67784d\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/ed716d97-cc00-453e-bee1-ac00d9510d24\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.1.0\" \"status\":\"live\" \"gets\":55 \"installs\":40 \"publishedAt\":\"2026-10-08T08:25:05.720Z\" \"updatedAt\":\"2026-10-08T10:36:20.711Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"9d84f478-cf8e-4b85-ae11-706bd6667918\" \"needs\":[{\"slug\":\"garrys-mod\"}] \"mode\":\"installed\" \"firstLaunch\":\"The first Play reads Iron Man, Hulk, Spider-Man and Thor from your own LEGO MARVEL Super Heroes and builds them for Garry's Mod (about half a minute, only once). Without LEGO MARVEL Super Heroes installed, the game opens as plain sandbox and says so.\" \"multiplayer\":null}} {\"id\":\"380fcd3b-74db-4a3e-b2df-5e8af2aae46f\" \"slug\":\"nine-lives-valley\" \"title\":\"Nine Lives Valley\" \"tagline\":\"Terraria with Stardew crops, Idleon monsters and classes, and Mewgenics cats you breed, fight beside and lose for good. I'll be improving it\" \"creator\":{\"id\":\"b4b4c346-a042-4071-9299-5d1c8e634341\" \"name\":\"UIShaggy\" \"avatarUrl\":\"/newpfp.png\" \"joinedAt\":\"2026-10-08T16:29:05.394Z\"} \"games\":[{\"slug\":\"terraria\" \"name\":\"Terraria\" \"shortName\":\"Terraria\" \"steamAppId\":\"105600\"} {\"slug\":\"stardew-valley\" \"name\":\"Stardew Valley\" \"shortName\":\"Stardew\" \"steamAppId\":\"413150\"} {\"slug\":\"custom-legends-of-idleon\" \"name\":\"Legends of IdleOn\" \"shortName\":\"Legends of IdleOn\"} {\"slug\":\"custom-mewgenics\" \"name\":\"Mewgenics\" \"shortName\":\"Mewgenics\" \"steamAppId\":\"686060\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/143b0a42-bffc-423b-a5e3-f22d50040a5a\" \"previewMedia\":[{\"url\":\"/api/mods/media/143b0a42-bffc-423b-a5e3-f22d50040a5a\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/19a88bb1-c0cd-49f0-865a-584db8be21ad\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/fbc804f1-2bea-4b84-abed-b2f7333d3d01\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/ebab3522-30a0-4049-9adf-ebd1443bbc4b\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/bf5ed078-48c3-4126-94b5-d8f10e87ce1f\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/50237d6c-e3cf-4517-ab4e-444dcaec97ae\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.2.0\" \"status\":\"live\" \"gets\":20 \"installs\":14 \"publishedAt\":\"2026-10-09T04:24:42.381Z\" \"updatedAt\":\"2026-10-09T04:53:57.054Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"80186668-7ad0-4b1b-9276-a8ba612df6ca\" \"needs\":[{\"slug\":\"terraria\" \"version\":\"\u003e=1.4.5\"} {\"slug\":\"stardew-valley\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":null}} {\"id\":\"7d3703cb-554f-46b7-9234-9c8b6d31a610\" \"slug\":\"halo-craft-zombies\" \"title\":\"Halo Craft Zombies\" \"tagline\":\"Black Ops III Zombies rounds in Minecraft, fought as a Spartan with real Halo: Reach guns.\" \"creator\":{\"id\":\"43f59361-8067-4ad6-a8f7-6f5b13ed6f48\" \"name\":\"Lane Sisson\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocKd02AAa8JiF8rL4HsCtaKRmp8rDBgW3V6nhIvsQAaPUsD3cg=s96-c\" \"joinedAt\":\"2026-10-08T18:35:17.924Z\"} \"games\":[{\"slug\":\"minecraft-java\" \"name\":\"Minecraft: Java Edition\" \"shortName\":\"Minecraft\" \"storeUrl\":\"https://www.minecraft.net/en-us/store/minecraft-java-bedrock-edition-pc\"} {\"slug\":\"halo-mcc\" \"name\":\"Halo: The Master Chief Collection\" \"shortName\":\"Master Chief Collection\" \"steamAppId\":\"976730\"} {\"slug\":\"custom-call-of-duty-black-ops-iii\" \"name\":\"Call of Duty: Black Ops III\" \"shortName\":\"Black Ops III\" \"steamAppId\":\"311210\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/affdbf87-3a7f-4c7c-a618-494c42d817af\" \"previewMedia\":[{\"url\":\"/api/mods/media/affdbf87-3a7f-4c7c-a618-494c42d817af\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/139f7087-4965-450e-8478-35997d75182d\" \"kind\":\"image\"}] \"madeBy\":\"FallenRevenant\" \"version\":\"0.1.0\" \"status\":\"live\" \"gets\":33 \"installs\":13 \"publishedAt\":\"2026-10-09T01:45:35.203Z\" \"updatedAt\":\"2026-10-09T01:45:35.203Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"d5ad23a9-4bbd-49c2-bf13-e37d59846f1b\" \"needs\":[{\"slug\":\"minecraft-java\" \"provisioned\":true} {\"slug\":\"halo-mcc\"}] \"mode\":\"installed\" \"firstLaunch\":\"Nothing to set up. On the first start Spartan Zombies reads Halo: Reach from your Master Chief Collection and the Zombies sounds from your Black Ops III by itself (about 10 seconds), then goes straight into the arena. Keys: left click fire, R reload, V melee, F buy, rebuild and revive.\" \"multiplayer\":{\"maxPlayers\":4 \"connects\":true}}} {\"id\":\"da28ea94-71e3-44c2-bcff-0b3dd03c338d\" \"slug\":\"skate-boost\" \"title\":\"Skate \u0026 Boost\" \"tagline\":\"Hornet rollerblades through Pharloom with a Rocket League boost meter while Get To Work's narrator heckles her and the Grindset plays.\" \"creator\":{\"id\":\"c0eb8774-1599-4040-933e-36e53340678e\" \"name\":\"daniel beck\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocJOMDT7XAKou5mr768LI2EgruhFF408QdNh5j4wZn0aqYswv58=s96-c\" \"joinedAt\":\"2026-10-09T10:37:20.678Z\"} \"games\":[{\"slug\":\"hollow-knight-silksong\" \"name\":\"Hollow Knight: Silksong\" \"shortName\":\"Silksong\" \"steamAppId\":\"1030300\"} {\"slug\":\"rocket-league\" \"name\":\"Rocket League\" \"shortName\":\"Rocket League\" \"steamAppId\":\"252950\"} {\"slug\":\"custom-get-to-work\" \"name\":\"Get to Work\" \"shortName\":\"Get to Work\" \"steamAppId\":\"2706170\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/8fb59898-9935-42e3-9c1f-f048b8681696\" \"previewMedia\":[{\"url\":\"/api/mods/media/8fb59898-9935-42e3-9c1f-f048b8681696\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"1.0.0\" \"status\":\"live\" \"gets\":9 \"installs\":4 \"publishedAt\":\"2026-10-09T12:20:05.500Z\" \"updatedAt\":\"2026-10-09T12:20:05.500Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"eda5f481-8d2d-4d4d-bdac-c3256266cc5d\" \"needs\":[{\"slug\":\"hollow-knight-silksong\"} {\"slug\":\"rocket-league\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":null}} {\"id\":\"47d1d98e-32cc-493c-8396-dc776dbcdb9a\" \"slug\":\"hero-stats\" \"title\":\"Hero Stats\" \"tagline\":\"Minecraft survival with Overwatch's health, armor and shields. Pick Reinhardt, Zarya or Tracer.\" \"creator\":{\"id\":\"2031ac3a-a99c-424b-b2bf-d55e37b1ba1b\" \"name\":\"EQQX2 / BeBo" (Indicator: ""scp") in Source: 00000000-00002316.00000000.124337.20A80000.00000004.mdmp Observed string: "\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocKfRhKmrHRJTas21ipYCFALH7In-RdfFJ2d_75h8l5W3S5M4VU=s96-c\" \"joinedAt\":\"2026-10-07T19:23:35.788Z\"} \"games\":[{\"slug\":\"team-fortress-2\" \"name\":\"Team Fortress 2\" \"shortName\":\"Team Fortress 2\" \"steamAppId\":\"440\"} {\"slug\":\"custom-the-binding-of-isaac-rebirth\" \"name\":\"The Binding of Isaac: Rebirth\" \"shortName\":\"Rebirth\" \"steamAppId\":\"250900\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/65838eee-3389-46b6-b03b-3d7b1b54c950\" \"previewMedia\":[{\"url\":\"/api/mods/media/65838eee-3389-46b6-b03b-3d7b1b54c950\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.1.0\" \"status\":\"live\" \"gets\":69 \"installs\":64 \"publishedAt\":\"2026-10-07T20:50:05.144Z\" \"updatedAt\":\"2026-10-07T20:50:05.144Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"b52f27ba-8212-4046-ac90-218e9d1cde4e\" \"needs\":[{\"slug\":\"team-fortress-2\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":null}} {\"id\":\"57b3abbf-5819-4b4b-9b31-57acb21022d9\" \"slug\":\"lego-peak-wars-complete-saga\" \"title\":\"LEGO PEAK Wars: Complete Saga\" \"tagline\":\"Climb PEAK as any LEGO Star Wars: The Complete Saga character, with their moves, voices and music, from your own copy.\" \"creator\":{\"id\":\"797bebc1-bfdd-4182-b220-cabe932a1d35\" \"name\":\"Tiritatk\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocI-dmhfKnFmW0tcAaRcQvmgKCoXegQP4K8COX8Sc8SgFWTykV84Zw=s96-c\" \"joinedAt\":\"2026-10-05T18:12:06.144Z\"} \"games\":[{\"slug\":\"peak\" \"name\":\"PEAK\" \"shortName\":\"PEAK\" \"steamAppId\":\"3527290\"} {\"slug\":\"custom-lego-star-wars-the-complete-saga\" \"name\":\"Lego Star Wars: The Complete Saga\" \"shortName\":\"The Complete Saga\" \"steamAppId\":\"32440\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/d0fecab7-ddcd-4593-9601-272b98531047\" \"previewMedia\":[{\"url\":\"/api/mods/media/ea4b66c9-a2e0-4458-bb13-29c214be0fc9\" \"kind\":\"video\"} {\"url\":\"/api/mods/media/d0fecab7-ddcd-4593-9601-272b98531047\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/979b925d-5fe4-49f5-bb0c-deb8ba3e98f4\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/3c605209-e9f8-462f-871c-4c83e47e494f\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/a3a79a9f-0782-4690-84e1-c22513702bb0\" \"kind\":\"image\"}] \"madeBy\":\"Tiritatk\" \"version\":\"0.1.0\" \"status\":\"live\" \"gets\":5 \"installs\":4 \"publishedAt\":\"2026-10-09T15:32:05.548Z\" \"updatedAt\":\"2026-10-09T15:32:05.548Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"4809d22e-d393-4b64-8088-ae97e5019c0c\" \"needs\":[{\"slug\":\"peak\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":{\"maxPlayers\":null \"connects\":false}}} {\"id\":\"fa28eff8-7099-4cb5-8449-ea360b04952b\" \"slug\":\"seed-478868574082066804\" \"title\":\"Seed 478868574082066804\" \"tagline\":\"Walk the 2010 Herobrine world with today's Minecraft: Alpha terrain, Alpha look, Alpha recipes.\" \"creator\":{\"id\":\"2e99d10d-d9c3-4bc0-a390-69429b0028f0\" \"name\":\"Offline\" \"avatarUrl\":\"/api/mods/people/2e99d10d-d9c3-4bc0-a390-69429b0028f0/photo?v=7181d42fc8de\" \"joinedAt\":\"2026-10-07T18:15:49.627Z\"} \"games\":[{\"slug\":\"minecraft-java\" \"name\":\"Minecraft: Java Edition\" \"shortName\":\"Minecraft\" \"storeUrl\":\"https://www.minecraft.net/en-us/store/minecraft-java-bedrock-edition-pc\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/810509ad-f693-42ee-a920-db139dd6d9bd\" \"previewMedia\":[{\"url\":\"/api/mods/media/810509ad-f693-42ee-a920-db139dd6d9bd\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/fd375efa-afd9-4953-aed2-69989daeeb5a\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/36ddbff1-fefd-485f-9a6f-a34d0bb8b176\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/4789408a-e30b-4267-bc69-304d61349501\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/54a45ff6-8750-479b-acf5-01b758374e27\" \"kind\":\"image\"}] \"madeBy\":\"Aire\" \"version\":\"0.1.10\" \"status\":\"live\" \"gets\":68 \"installs\":65 \"publishedAt\":\"2026-10-07T21:37:35.190Z\" \"updatedAt\":\"2026-10-08T20:27:05.838Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"7bdb46b3-8cce-49c9-89a5-eab28c52cc5b\" \"needs\":[{\"slug\":\"minecraft-java\" \"provisioned\":true}] \"mode\":\"installed\" \"firstLaunch\":\"Sign in to your Microsoft account in Prism Launcher if it asks; it then downloads Minecraft 26.2, Fabric and Java by itself. The game opens straight into Herobrine World. Type /creative or /survival in chat to switch game mode. Replay Mod records every session; exporting a replay to video needs FFmpeg, which you install yourself.\" \"multiplayer\":null}} {\"id\":\"bc79506e-fb87-4269-a6e1-42b34cc82a67\" \"slug\":\"portal-gun-l4d2-2\" \"title\":\"portal gun l4d2\" \"tagline\":\"inspirado en portal2\" \"creator\":{\"id\":\"2e8ffc8a-20d3-495d-a6e3-38be960a74d1\" \"name\":\"Jaime Alonso\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocKBBDIRfq_6EfqsY3PC0HJ-mdeb2Df2EtkEJPxF1OkjQI_A_w=s96-c\" \"joinedAt\":\"2026-10-09T17:27:31.492Z\"} \"games\":[{\"slug\":\"left-4-dead-2\" \"name\":\"Left 4 Dead 2\" \"shortName\":\"Left 4 Dead 2\" \"steamAppId\":\"550\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":null \"previewMedia\":[] \"madeBy\":null \"version\":\"1.0.0\" \"status\":\"live\" \"gets\":3 \"installs\":2 \"publishedAt\":\"2026-10-09T18:18:05.852Z\" \"updatedAt\":\"2026-10-09T18:18:05.852Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"72c1e3fc-8e19-428f-9d17-3a0f2813547f\" \"needs\":[{\"slug\":\"left-4-dead-2\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":null}} {\"id\":\"edd79064-a7cd-4490-ac19-408819403e89\" \"slug\":\"the-sift\" \"title\":\"The Sift\" \"tagline\":\"Minecraft Dungeons II's Sift as a new dimension in Minecraft Java. Play the Singer's melody at an ancient city portal to get there.\" \"creator\":{\"id\":\"8a49318f-d248-49d3-a230-38e626f18f18\" \"name\":\"fewmet\" \"avatarUrl\":\"/api/mods/people/8a49318f-d248-49d3-a230-38e626f18f18/photo?v=bebc528eb1fd\" \"joinedAt\":\"2026-10-06T02:54:05.658Z\"} \"games\":[{\"slug\":\"minecraft-java\" \"name\":\"Minecraft: Java Edition\" \"shortName\":\"Minecraft\" \"storeUrl\":\"https://www.minecraft.net/en-us/store/minecraft-java-bedrock-edition-pc\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/38d1531a-6111-43a6-bd1a-e1ebdf2c14a8\" \"previewMedia\":[{\"url\":\"/api/mods/media/38d1531a-6111-43a6-bd1a-e1ebdf2c14a8\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/ebcc1bac-1c35-46fe-a15b-d2a31443713c\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/2f74d628-f576-40b4-8958-44acdeb0fd98\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/a7625a3b-fce6-4a35-9959-09aa318ef975\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/ed5ae2a8-c6fe-4be8-a2c2-931b0a3dab5a\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/64814146-da35-44a9-8f90-3ac0158ccf82\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.2.0\" \"status\":\"live\" \"gets\":111 \"installs\":104 \"publishedAt\":\"2026-10-06T19:27:55.244Z\" \"updatedAt\":\"2026-10-06T23:41:06.080Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"c7417b0f-8ffc-4b91-a3e3-88a043b087ba\" \"needs\":[{\"slug\":\"minecraft-java\" \"provisioned\":true}] \"mode\":\"installed\" \"firstLaunch\":\"Sign in to Prism Launcher with your Microsoft account the first time. To reach the Sift, play B flat, D sharp, G, G sharp, D, C sharp, E, A on note blocks by an ancient city's portal frame.\" \"multiplayer\":null}} {\"id\":\"ea7af7fb-c52c-479d-a7e7-cabd0ba535c7\" \"slug\":\"lethal-containment\" \"title\":\"Lethal Containment\" \"tagline\":\"Every moon's facility is SCP - Containment Breach: its rooms, SCP-173, 096, 106 and 049, keycards and the blink meter, from your own copy.\" \"creator\":{\"id\":\"7afab38e-529d-47d3-a271-48e81919663c\" \"name\":\"Beck\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocKq-Sc2ASkDZ7tzpqBi-amHBwa2plJvoQkspOmiduxK-ZkqnuM=s96-c\" \"joinedAt\":\"2026-10-09T03:35:27.576Z\"} \"games\":[{\"slug\":\"lethal-company\" \"name\":\"Lethal Company\" \"shortName\":\"Lethal Company\" \"steamAppId\":\"1966720\"} {\"slug\":\"custom-scp-containment-breach\" \"name\":\"SCP - Containment Breach\" \"shortName\":\"SCP - Containment Breach\" \"steamAppId\":\"3831680\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/208b5337-eb51-46c0-ae60-b4d52138131b\" \"previewMedia\":[{\"url\":\"/api/mods/media/208b5337-eb51-46c0-ae60-b4d52138131b\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/175643c3-1b0e-45ca-b197-4ea608d3f15c\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/6ff30e7f-0303-4842-97e5-b322ec8fc25b\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/bdfde11b-ddb8-4192-b30a-baa158708ad3\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/8328e4fb-bcb2-4dd9-9604-1ea6e74b9df2\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.1.1\" \"status\":\"live\" \"gets\":16 \"installs\":13 \"publishedAt\":\"2026-10-09T06:54:11.267Z\" \"updatedAt\":\"2026-10-09T07:25:40.240Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"cb21ad92-27e1-4bef-82e9-83dd0a20b59a\" \"needs\":[{\"slug\":\"lethal-company\"}] \"mode\":\"installed\" \"firstLaunch\":\"Host a game, land on any moon and go in through the main entrance: the facility inside is the Foundation site. Press B to blink on purpose. If SCP - Containment Breach is not installed, the game says so and plays as plain Lethal Company.\" \"multiplayer\":null}} {\"id\":\"799e359d-eddc-4e0d-8bd0-722f85785d27\" \"slug\":\"lords-of-the-island\" \"title\":\"Lords of the Island\" \"tagline\":\"Lords of the Fallen bosses roam the Sons of the Forest island. Hunt them, alone or with friends, for their weapons and Remembrances.\" \"creator\":{\"id\":\"0bc43549-469c-463f-9c4b-53affeca91c8\" \"name\":\"christopher lemelin\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocJW2VCFK6RpDYdX3nuU5f9eP7BAyfymodklBSEJC2miVNPo3Bk=s96-c\" \"joinedAt\":\"2026-10-09T12:29:17.905Z\"} \"games\":[{\"slug\":\"sons-of-the-forest\" \"name\":\"Sons of the Forest\" \"shortName\":\"Sons of the Forest\" \"steamAppId\":\"1326470\"} {\"slug\":\"custom-lords-of-the-fallen\" \"name\":\"Lords of the Fallen\" \"shortName\":\"Lords of the Fallen\" \"steamAppId\":\"1501750\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/4493f90f-d643-460a-8004-2df52251a8c1\" \"previewMedia\":[{\"url\":\"/api/mods/media/4493f90f-d643-460a-8004-2df52251a8c1\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"1.0.0\" \"status\":\"live\" \"gets\":2 \"installs\":2 \"publishedAt\":\"2026-10-09T18:20:06.048Z\" \"updatedAt\":\"2026-10-09T18:20:06.048Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"062ed572-45ec-451c-a4de-dc70f05a8eee\" \"needs\":[{\"slug\":\"sons-of-the-forest\"} {\"slug\":\"custom-lords-of-the-fallen\"}] \"mode\":\"installed\" \"firstLaunch\":\"The first Play takes about a minute longer while the bosses are prepared from your Lords of the Fallen install.\" \"multiplayer\":{\"maxPlayers\":8 \"connects\":false}}} {\"id\":\"85edaf1a-cdde-49ec-8272-010a70d2e1d0\" \"slug\":\"lego-marvel-heroes\" \"title\":\"LEGO Marvel Heroes\" \"tagline\":\"Play GMod sandbox as the real LEGO Marvel Iron Man, Hulk, Spider-Man and Thor: powers, studs, and falling apart into bricks.\" \"creator\":{\"id\":\"4843b3c5-4cea-4b2c-866b-9df06f543f22\" \"name\":\"Lex Wiaczek\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocLUL7EdER5cVMQC-3UIY50fQgwKcBf83FEWl0ez0yJTIUr5CmI=s96-c\" \"joinedAt\":\"2026-10-06T08:55:16.792Z\"} \"games\":[{\"slug\":\"garrys-mod\" \"name\":\"Garry's Mod\" \"shortName\":\"Garry's Mod\" \"steamAppId\":\"4000\"} {\"slug\":\"custom-lego-marvel-super-heroes\" \"name\":\"Lego Marvel Super Heroes\" \"shortName\":\"Lego Marvel Super Heroes\" \"steamAppId\":\"249130\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/4d09e6d8-1548-40c8-a6c3-47d76fd3c439\" \"previewMedia\":[{\"url\":\"/api/mods/media/4d09e6d8-1548-40c8-a6c3-47d76fd3c439\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/86cd90bd-e66c-4659-a28f-04117769c281\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/691d02c1-e7d2-4eed-9a78-3b643177d146\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/b59a4438-cb6e-40c8-aa1e-54aa34217022\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/4f0c0822-bfa6-4174-a781-23db7c67784d\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/ed716d97-cc00-453e-bee1-ac00d9510d24\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.1.0\" \"status\":\"live\" \"gets\":55 \"installs\":40 \"publishedAt\":\"2026-10-08T08:25:05.720Z\" \"updatedAt\":\"2026-10-08T10:36:20.711Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"9d84f478-cf8e-4b85-ae11-706bd6667918\" \"needs\":[{\"slug\":\"garrys-mod\"}] \"mode\":\"installed\" \"firstLaunch\":\"The first Play reads Iron Man, Hulk, Spider-Man and Thor from your own LEGO MARVEL Super Heroes and builds them for Garry's Mod (about half a minute, only once). Without LEGO MARVEL Super Heroes installed, the game opens as plain sandbox and says so.\" \"multiplayer\":null}} {\"id\":\"380fcd3b-74db-4a3e-b2df-5e8af2aae46f\" \"slug\":\"nine-lives-valley\" \"title\":\"Nine Lives Valley\" \"tagline\":\"Terraria with Stardew crops, Idleon monsters and classes, and Mewgenics cats you breed, fight beside and lose for good. I'll be improving it\" \"creator\":{\"id\":\"b4b4c346-a042-4071-9299-5d1c8e634341\" \"name\":\"UIShaggy\" \"avatarUrl\":\"/newpfp.png\" \"joinedAt\":\"2026-10-08T16:29:05.394Z\"} \"games\":[{\"slug\":\"terraria\" \"name\":\"Terraria\" \"shortName\":\"Terraria\" \"steamAppId\":\"105600\"} {\"slug\":\"stardew-valley\" \"name\":\"Stardew Valley\" \"shortName\":\"Stardew\" \"steamAppId\":\"413150\"} {\"slug\":\"custom-legends-of-idleon\" \"name\":\"Legends of IdleOn\" \"shortName\":\"Legends of IdleOn\"} {\"slug\":\"custom-mewgenics\" \"name\":\"Mewgenics\" \"shortName\":\"Mewgenics\" \"steamAppId\":\"686060\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/143b0a42-bffc-423b-a5e3-f22d50040a5a\" \"previewMedia\":[{\"url\":\"/api/mods/media/143b0a42-bffc-423b-a5e3-f22d50040a5a\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/19a88bb1-c0cd-49f0-865a-584db8be21ad\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/fbc804f1-2bea-4b84-abed-b2f7333d3d01\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/ebab3522-30a0-4049-9adf-ebd1443bbc4b\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/bf5ed078-48c3-4126-94b5-d8f10e87ce1f\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/50237d6c-e3cf-4517-ab4e-444dcaec97ae\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"0.2.0\" \"status\":\"live\" \"gets\":20 \"installs\":14 \"publishedAt\":\"2026-10-09T04:24:42.381Z\" \"updatedAt\":\"2026-10-09T04:53:57.054Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"80186668-7ad0-4b1b-9276-a8ba612df6ca\" \"needs\":[{\"slug\":\"terraria\" \"version\":\"\u003e=1.4.5\"} {\"slug\":\"stardew-valley\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":null}} {\"id\":\"7d3703cb-554f-46b7-9234-9c8b6d31a610\" \"slug\":\"halo-craft-zombies\" \"title\":\"Halo Craft Zombies\" \"tagline\":\"Black Ops III Zombies rounds in Minecraft, fought as a Spartan with real Halo: Reach guns.\" \"creator\":{\"id\":\"43f59361-8067-4ad6-a8f7-6f5b13ed6f48\" \"name\":\"Lane Sisson\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocKd02AAa8JiF8rL4HsCtaKRmp8rDBgW3V6nhIvsQAaPUsD3cg=s96-c\" \"joinedAt\":\"2026-10-08T18:35:17.924Z\"} \"games\":[{\"slug\":\"minecraft-java\" \"name\":\"Minecraft: Java Edition\" \"shortName\":\"Minecraft\" \"storeUrl\":\"https://www.minecraft.net/en-us/store/minecraft-java-bedrock-edition-pc\"} {\"slug\":\"halo-mcc\" \"name\":\"Halo: The Master Chief Collection\" \"shortName\":\"Master Chief Collection\" \"steamAppId\":\"976730\"} {\"slug\":\"custom-call-of-duty-black-ops-iii\" \"name\":\"Call of Duty: Black Ops III\" \"shortName\":\"Black Ops III\" \"steamAppId\":\"311210\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/affdbf87-3a7f-4c7c-a618-494c42d817af\" \"previewMedia\":[{\"url\":\"/api/mods/media/affdbf87-3a7f-4c7c-a618-494c42d817af\" \"kind\":\"image\"} {\"url\":\"/api/mods/media/139f7087-4965-450e-8478-35997d75182d\" \"kind\":\"image\"}] \"madeBy\":\"FallenRevenant\" \"version\":\"0.1.0\" \"status\":\"live\" \"gets\":33 \"installs\":13 \"publishedAt\":\"2026-10-09T01:45:35.203Z\" \"updatedAt\":\"2026-10-09T01:45:35.203Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"d5ad23a9-4bbd-49c2-bf13-e37d59846f1b\" \"needs\":[{\"slug\":\"minecraft-java\" \"provisioned\":true} {\"slug\":\"halo-mcc\"}] \"mode\":\"installed\" \"firstLaunch\":\"Nothing to set up. On the first start Spartan Zombies reads Halo: Reach from your Master Chief Collection and the Zombies sounds from your Black Ops III by itself (about 10 seconds), then goes straight into the arena. Keys: left click fire, R reload, V melee, F buy, rebuild and revive.\" \"multiplayer\":{\"maxPlayers\":4 \"connects\":true}}} {\"id\":\"da28ea94-71e3-44c2-bcff-0b3dd03c338d\" \"slug\":\"skate-boost\" \"title\":\"Skate \u0026 Boost\" \"tagline\":\"Hornet rollerblades through Pharloom with a Rocket League boost meter while Get To Work's narrator heckles her and the Grindset plays.\" \"creator\":{\"id\":\"c0eb8774-1599-4040-933e-36e53340678e\" \"name\":\"daniel beck\" \"avatarUrl\":\"https://lh3.googleusercontent.com/a/ACg8ocJOMDT7XAKou5mr768LI2EgruhFF408QdNh5j4wZn0aqYswv58=s96-c\" \"joinedAt\":\"2026-10-09T10:37:20.678Z\"} \"games\":[{\"slug\":\"hollow-knight-silksong\" \"name\":\"Hollow Knight: Silksong\" \"shortName\":\"Silksong\" \"steamAppId\":\"1030300\"} {\"slug\":\"rocket-league\" \"name\":\"Rocket League\" \"shortName\":\"Rocket League\" \"steamAppId\":\"252950\"} {\"slug\":\"custom-get-to-work\" \"name\":\"Get to Work\" \"shortName\":\"Get to Work\" \"steamAppId\":\"2706170\"}] \"pricing\":\"free\" \"priceCents\":0 \"currency\":\"usd\" \"coverUrl\":\"/api/mods/media/8fb59898-9935-42e3-9c1f-f048b8681696\" \"previewMedia\":[{\"url\":\"/api/mods/media/8fb59898-9935-42e3-9c1f-f048b8681696\" \"kind\":\"image\"}] \"madeBy\":null \"version\":\"1.0.0\" \"status\":\"live\" \"gets\":9 \"installs\":4 \"publishedAt\":\"2026-10-09T12:20:05.500Z\" \"updatedAt\":\"2026-10-09T12:20:05.500Z\" \"remixOfId\":null \"play\":{\"releaseId\":\"eda5f481-8d2d-4d4d-bdac-c3256266cc5d\" \"needs\":[{\"slug\":\"hollow-knight-silksong\"} {\"slug\":\"rocket-league\"}] \"mode\":\"installed\" \"firstLaunch\":null \"multiplayer\":null}} {\"id\":\"47d1d98e-32cc-493c-8396-dc776dbcdb9a\" \"slug\":\"hero-stats\" \"title\":\"Hero Stats\" \"tagline\":\"Minecraft survival with Overwatch's health, armor and shields. Pick Reinhardt, Zarya or Tracer.\" \"creator\":{\"id\":\"2031ac3a-a99c-424b-b2bf-d55e37b1ba1b\" \"name\":\"EQQX2 / BeBo" (Indicator: " scp ") in Source: 00000000-00002316.00000000.124337.20A80000.00000004.mdmp Observed string: "The Definitive Edition" href="/g/custom-grand-theft-auto-san-andreas-the-definitive-edition">

1 mashup