24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 943e3d0534eb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 943e3d0534eb…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 4/27 AV engines flagged this file. 3 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1"],"about":{"@type":"SoftwareApplication","name":"download.dat","applicationCategory":["pedll","64bits","executable"],"identifier":"943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7fc,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "[ERROR] %s:%d: VirtualFree failed." (Indicator: "VirtualFree"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "[ERROR] %s:%d: VirtualFree failed." (Indicator: "VirtualFree"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp")26:Te6f,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp")27:T488,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp")28:T447,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "OutputDebugStringA" (Indicator: "OutputDebugString"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin")29:T6b6,Assembly shows XOR instruction xor rax rsp in Stream UID: 2107-101-0000000180001790 Assembly shows XOR instruction xor eax esp in Stream UID: 2107-101-0000000180001790 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2107-101-0000000180001790 Assembly shows XOR instruction xor ecx esp in Stream UID: 2107-101-0000000180001790 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2107-758-000000018000B778 Assembly shows XOR instruction xor ecx esp in Stream UID: 2107-758-000000018000B778 Assembly shows XOR instruction xor rax rsp in Stream UID: 2107-759-0000000180014A94 Assembly shows XOR instruction xor eax esp in Stream UID: 2107-759-0000000180014A94 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2107-759-0000000180014A94 Assembly shows XOR instruction xor ecx esp in Stream UID: 2107-759-0000000180014A94 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2107-922-0000000180017D75 Assembly shows XOR instruction xor ecx esp in Stream UID: 2107-922-0000000180017D75 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2107-925-0000000180017EED Assembly shows XOR instruction xor ecx esp in Stream UID: 2107-925-0000000180017EED Assembly shows XOR instruction xor rcx rsp in Stream UID: 2107-933-00000001800181B8 Assembly shows XOR instruction xor ecx esp in Stream UID: 2107-933-00000001800181B8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 2107-943-000000018001925A Assembly shows XOR instruction xor ecx esp in Stream UID: 2107-943-000000018001925A Assembly shows XOR instruction xor rcx rbp in Stream UID: 2107-957-000000018001AE24 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2107-957-000000018001AE242a:T1600,Contains base64 string in header "download" in header "GET /uc?export=download&id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "like" in header "GET /uc?export=download&id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "comCache" in header "GET /uc?export=download&id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "download" in header "GET /download?id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /download?id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /download?id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "download" in header "GET /uc?export=download&id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "like" in header "GET /uc?export=download&id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "comCache" in header "GET /uc?export=download&id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "download" in header "GET /download?id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /download?id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /download?id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "download" in header "GET /uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "like" in header "GET /uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "comCache" in header "GET /uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" Contains base64 string in header "download" in header "GET /download?id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /download?id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /download?id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive"2b:T19fb,Found XOR loop in file "Taskmgr.exe" at offset 1005433; code bytes = 30d0 Found XOR loop in file "Taskmgr.exe" at offset 1296140; code bytes = 30d0 Found XOR loop in file "Taskmgr.exe" at offset 1299536; code bytes = 30d0 Found XOR loop in file "Taskmgr.exe" at offset 21063; code bytes = 33c1 Found XOR loop in file "Taskmgr.exe" at offset 185642; code bytes = 33c1 Found XOR loop in file "Taskmgr.exe" at offset 185662; code bytes = 33c1 Found XOR loop in file "Taskmgr.exe" at offset 313345; code bytes = 33c1 Found XOR loop in file "Taskmgr.exe" at offset 12797; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 12817; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 198085; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 433269; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 925820; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 929991; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 998277; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1025752; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1026735; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1089921; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1184245; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1187843; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1187913; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1187967; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1188271; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1206469; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1209487; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1210131; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1210811; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1211351; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1212245; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1212515; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1212833; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1213639; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1216603; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1217043; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1217483; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1218047; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1220293; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1223719; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1224359; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1224539; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1224599; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1224631; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1225917; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1225931; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1225991; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1226059; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1226115; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1226175; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1226355; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1226415; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1226559; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1226743; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1226867; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1227395; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1227455; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1227523; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1227583; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1227651; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1227751; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1227803; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1228507; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1228575; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1228727; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1228787; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229043; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229099; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229155; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229219; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229275; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229419; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229475; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229531; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229599; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1229655; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1230271; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1230443; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1230499; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1230995; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1231331; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1231547; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1231591; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1231675; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1231791; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1231843; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1231875; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1232924; code bytes = 8030 Found XOR loop in file "Taskmgr.exe" at offset 1305194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 33684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 45563; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 123868; code bytes = 80302c:T6aa,Found string "youtube.com" (Indicator: "youtube.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.28BC0000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found string "*.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.28BC0000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found string "music.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.28BC0000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found string "*.music.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.28BC0000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found string "usercontent.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.28BC0000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "*.usercontent.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.28BC0000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp")2d:T7f0,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp")2e:T946,Found system information discovery API: "GetEnvironmentStringsW" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "GetUserObjectInformationW" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "GetMonitorInfoW" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "ExpandEnvironmentStringsA" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "ExpandEnvironmentStringsW" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "SHExpandEnvironmentStringsW" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "GetSystemInfo" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "GetNativeSystemInfo" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "NtQuerySystemInformation" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "RtlNtStatusToDosError" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "NtQuerySystemInformationEx" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in file "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00000696.00000000.169694.685C8000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp"2f:Tc56,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac1e0bfc7f0000000000000000000051ed380cfc7f000000000000fc7f0000000000000000000088cff3ab114d0000000001001a00010040dd490cfc7f00008fec380cfc7f0000e0ac1e0bfc7f0000e0ac1e0bfc7f0000000000000000000000000000fc7f0000ffffff7f7821000000000000000000000000000000000000d8ce120bfc7f00002a0000000000000069c3cb0afc7f0000310000000000000088010000000000008c01000000000000120001130000000030f0d8da3600000003a3a70afc7f000030f0d8da3600000000000000000000002b00000000000000000000000000000020b0d10afc7f0000b43fd00afc7f0000e0ce120b (UID: 00000000-00000696) "rundll32.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696)30:T4aa,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "InternalGetWindowText" (Indicator: "GetWindowText"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "EnumDesktopsW" (Indicator: "EnumDesktops"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp")31:T4f7,"rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")32:T12db,"rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000696) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000696)33:T44d,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "[ERROR] CreateProcess failed, Error =" (Indicator: "CreateProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "11216835962,7352,3141,,CreateProcessA,kernel32.dll,"00:44:11.250",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API "[ERROR] CreateProcess failed, Error =" (Indicator: "CreateProcess"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp")34:T4ce,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp")35:T16f11,Found reference to API (Indicator: "VirtualProtectEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateFileA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateProcessA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EncodePointer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFileType"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetHandleCount"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetFilePointer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FlsSetValue"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetACP"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetStdHandle"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetThreadContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetOEMCP"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "HeapSetInformation"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "HeapFree"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CloseHandle"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ReadProcessMemory"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "Wow64SetThreadContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateFileMappingA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LCMapStringW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "OpenProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RaiseException"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "UpdateProcThreadAttribute"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsBadReadPtr"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsValidLocale"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "HeapAlloc"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FlsGetValue"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CopyFileA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetStdHandle"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetTickCount"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetCPInfo"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "HeapSize"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetProcAddress"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetThreadContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ExitProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFileSize"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetLastError"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ReadFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFileAttributesA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "TerminateProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLocaleInfoW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetCommandLineA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FlsAlloc"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeleteFileA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "WriteFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ResumeThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateFileW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "HeapCreate"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "WriteProcessMemory"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetConsoleCP"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetVersion"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "Sleep"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "HeapDestroy"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DecodePointer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FlsFree"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "Wow64GetThreadContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLastError"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "VirtualFree"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InternetOpenA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InternetReadFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeleteUrlCacheEntry"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InternetOpenUrlA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InternetCloseHandle"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetProcessWindowStation"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLastActivePopup"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetActiveWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "MessageBoxW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetDeviceCaps"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeleteObject"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SelectObject"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetPackageFullName"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "lstrlenW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegisterApplicationRestart"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetProcessWorkingSetSize"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetNumberFormatW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "lstrcpyW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SafeArrayPutElement"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "VariantClear"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SysAllocStringLen"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "VariantInit"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SysFreeString"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SysAllocString"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SysStringLen"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetupDiGetClassDevsW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetupDiGetDevicePropertyW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ShellExecuteW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CommandLineToArgvW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ShellExecuteExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SHCreateStreamOnFileEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "StrStrIW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "AssocQueryStringW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "StrToIntExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PtInRect"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetSubMenu"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetFocus"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetMenuDefaultItem"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetMenuItemID"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetClientRect"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ReleaseDC"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetMenu"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CloseClipboard"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsZoomed"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetMenu"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DestroyIcon"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LoadMenuW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PostQuitMessage"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "AppendMenuW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetThreadDesktop"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetParent"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CopyRect"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EmptyClipboard"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CheckMenuItem"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DestroyMenu"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreatePopupMenu"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LoadAcceleratorsW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeleteMenu"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CharLowerW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EnableMenuItem"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "KillTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SystemParametersInfoW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CharUpperBuffW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetClipboardData"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFocus"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetWindowTextW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LoadImageW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetMenuItemCount"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CloseDesktop"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetKeyState"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetDC"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetWindowPos"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EnumDesktopsW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DefWindowProcW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InsertMenuW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EnableWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetWindowRect"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "TrackPopupMenu"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RedrawWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "UnregisterClassW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "TranslateMessage"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateWindowExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetCursorPos"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EqualRect"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetWindowTextW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InvalidateRect"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CheckMenuRadioItem"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DestroyWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsIconic"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetScrollPos"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DispatchMessageW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LoadIconW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsWindowEnabled"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CopyIcon"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "MapWindowPoints"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsWindowVisible"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ShowWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EnumDesktopWindows"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "MessageBeep"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "OpenDesktopW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PeekMessageW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LoadStringW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetThreadDesktop"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "UpdateWindow"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RemoveMenu"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "OpenClipboard"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetMenuState"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetDateFormatW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetTimeFormatW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetDateFormatEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetDurationFormatEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DebugBreak"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DelayLoadFailureHook"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetErrorMode"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetErrorMode"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetDriveTypeW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CompareFileTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindNextChangeNotification"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindClose"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindFirstVolumeW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "QueryDosDeviceW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindNextFileW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindNextVolumeW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindVolumeClose"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLongPathNameW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindFirstFileW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetTempPathW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LocalFree"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LocalAlloc"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeviceIoControl"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CancelSynchronousIo"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetComputerNameW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "MulDiv"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FreeLibrary"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetThreadUILanguage"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FormatMessageW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetNumberFormatEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "VirtualUnlock"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ProcessIdToSessionId"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetPriorityClass"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateProcessW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetThreadPriority"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetExitCodeThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetThreadPriority"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetProcessTimes"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetPriorityClass"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetCurrentThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegEnumKeyExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegDeleteValueW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegSetValueExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegEnumValueW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegCreateKeyExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegGetValueW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RegCloseKey"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PathFileExistsW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PathIsRelativeW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PathRemoveBlanksW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PathStripPathW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PathRemoveExtensionW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "PathRemoveBackslashW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "QueryActCtxW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeactivateActCtx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ActivateActCtx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FindActCtxSectionStringW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateActCtxW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CompareStringEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CompareStringOrdinal"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateEventW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetEvent"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "OpenEventW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "OpenSemaphoreW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateMutexW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ReleaseSemaphore"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateEventExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ReleaseMutex"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateMutexExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "ResetEvent"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "InitOnceComplete"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLocalTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetVersionExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetSystemTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetComputerNameExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetTickCount64"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetSystemFirmwareTable"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetPhysicallyInstalledSystemMemory"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetProcessorSystemCycleTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateTimerQueueTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "DeleteTimerQueueTimer"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "QueueUserWorkItem"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFileVersionInfoExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "VerQueryValueW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsWow64Process"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EventWrite"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EventUnregister"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EventRegister"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CopySid"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "EqualSid"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FreeSid"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CheckTokenMembership"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "SetTokenInformation"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "CreateWellKnownSid"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "IsWellKnownSid"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "GetLengthSid"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtOpenFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlFreeHeap"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlAllocateHeap"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtSetInformationProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtQueryInformationFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlIpv4AddressToStringExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlSecondsSince1970ToTime"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtQueryInformationToken"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtQueryObject"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtSetInformationFile"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlNumberOfSetBitsUlongPtr"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlTimeToElapsedTimeFields"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlImageNtHeader"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "RtlIpv6AddressToStringExW"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "NtPowerInformation"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "EnumProcesses"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "NtLoadDriver"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "NtUnloadDriver"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "NtOpenThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "NtSuspendProcess"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "NtResumeProcess"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "NtTerminateThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000696.00000000.169694.28CC0000.00000004.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00000696.00000000.169694.685C8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "DeleteUrlCacheEntry"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp")36:T428,Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin")37:T5cf,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp 00000000-00000696.00000001.170068.26490000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00000696.00000000.169694.28CC0000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00000696.00000000.169694.28CC0000.00000004.mdmp "735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000696.00000001.170068.26490000.00000004.mdmp38:T576,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" (Indicator: "user-agent: "; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp")39:T621,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000696.00000000.169694.26490000.00000004.mdmp "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00000696.00000000.169694.28CC0000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00000696.00000000.169694.28CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000696.00000001.170068.26490000.00000004.mdmp "735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000696.00000001.170068.26490000.00000004.mdmp3a:T5c3f,"GET /uc?export=download&id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Host: drive.google.com Cache-Control: no-cache" Response ==> HTTP/1.1 303 See Other Content-Type: application/binary Vary: Origin Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Tue 07 Jul 2026 08:53:30 GMT Location: https://drive.usercontent.google.com/download?id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vBGlV6KK9DgYUhEElsIcUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "GET /download?id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream X-GUploader-UploadID: AJ5rDhH4jW4aa76g1M1VQkm2DBxitBizGJd3XN1oDMwFjeSjcLcg9_CWKO1BaItLExdM9a-vzFOca9c Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="app64.log" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept Accept-Language Authorization Cache-Control Content-Disposition Content-Encoding Content-Language Content-Length Content-MD5 Content-Range Content-Type Date developer-token financial-institution-id X-Goog-Sn-Metadata X-Goog-Sn-PatientId GData-Version google-cloud-resource-prefix linked-customer-id login-customer-id login-account linked-account x-goog-request-params Host If-Match If-Modified-Since If-None-Match If-Unmodified-Since Origin OriginToken Pragma Range request-id Signature Signature-Agent Signature-Input Slug Transfer-Encoding User-Agent hotrod-board-name hotrod-chrome-cpu-model hotrod-chrome-processors Want-Digest X-Ad-Manager-Impersonation x-chrome-connected X-ClientDetails X-Client-Pctx X-Client-Version x-debug-settings-metadata X-Firebase-AppId X-Firebase-AppVersion X-Firebase-Locale X-Goog-Firebase-Installations-Auth X-Firebase-Client X-Firebase-Client-Log-Type X-Firebase-GMPID X-Firebase-Auth-Token X-Firebase-AppCheck X-Firebase-RC-Fetch-Type X-Firebase-Token X-Goog-Drive-Client-Version X-Goog-Drive-Resource-Keys X-GData-Client X-GData-Key X-GoogApps-Allowed-Domains X-Goog-AdX-Buyer-Impersonation X-Goog-Api-Client X-Goog-Visibilities X-Goog-AuthUser X-Google-EOM x-goog-ext-124712974-jspb x-goog-ext-467253834-jspb x-goog-ext-353267353-bin x-goog-ext-353267353-jspb x-goog-ext-251363160-jspb X-Restricted-Content-Limit x-goog-ext-259736195-jspb x-goog-ext-477772811-jspb x-goog-ext-359275022-bin x-goog-ext-328800237-jspb x-goog-ext-198889211-bin x-goog-ext-202735639-bin x-goog-ext-223261916-bin x-goog-ext-223435598-bin x-goog-ext-233818517-bin x-goog-ext-202964622-bin X-Goog-PageId X-Goog-Encode-Response-If-Executable X-Goog-Correlation-Id X-Goog-Request-Info X-Goog-Request-Reason X-Goog-Request-Time X-Goog-Experiments x-goog-iam-authority-selector x-goog-iam-authorization-token X-Goog-Spatula X-Goog-Travel-Bgr X-Goog-Travel-Settings X-Goog-Upload-Command X-Goog-Upload-Content-Disposition X-Goog-Upload-Content-Length X-Goog-Upload-Content-Type X-Goog-Upload-File-Name X-Goog-Upload-Header-Content-Encoding X-Goog-Upload-Header-Content-Length X-Goog-Upload-Header-Content-Type X-Goog-Upload-Header-Transfer-Encoding X-Goog-Upload-Offset X-Goog-Upload-Protocol x-goog-user-project X-Goog-Visitor-Id X-Goog-FieldMask X-Google-Project-Override x-goog-maps-api-salt x-goog-maps-api-signature x-goog-maps-client-id X-Goog-Api-Key x-goog-spanner-database-role X-HTTP-Method-Override X-JavaScript-User-Agent X-Pan-Versionid X-Proxied-User-IP X-Origin X-Referer X-Requested-With X-Stadia-Client-Context X-Upload-Content-Length X-Upload-Content-Type X-Use-Alt-Service X-Use-HTTP-Status-Code-Override X-Ios-Bundle-Identifier X-Places-Ios-Sdk X-Android-Package X-Android-Cert X-Places-Android-Sdk X-Goog-Maps-Ios-Uuid X-Goog-Maps-Android-Uuid X-Ariane-Xsrf-Token X-A2A-Extensions X-YouTube-Bootstrap-Logged-In X-Youtube-Client-Name X-Youtube-Client-Version X-Youtube-Finch-Config-Data X-Youtube-Finch-Hash-Data X-YouTube-Lava-Device-Context X-YouTube-VVT X-YouTube-Page-CL X-YouTube-Page-Label X-YouTube-Page-Timestamp X-Compass-Routing-Destination x-framework-xsrf-token X-Goog-Meeting-ABR X-Goog-Meeting-Botguardid X-Goog-Meeting-Bot-Info X-Goog-Meeting-ClientInfo X-Goog-Meeting-ClientVersion X-Goog-Meeting-Debugid X-Goog-Meeting-Identifier X-Goog-Meeting-Interop-Cohorts X-Goog-Meeting-Interop-Type X-Goog-Meeting-OidcIdToken X-Goog-Meeting-RtcClient X-Goog-Meeting-StartSource X-Goog-Meeting-Token X-Goog-Meeting-Viewer-Token X-Goog-Healthcare-Audit-First-Party-Application-Access Prefer X-Client-Data x-sdm-id-token X-Sfdc-Authorization MIME-Version Content-Transfer-Encoding X-Earth-Engine-App-ID-Token X-Earth-Engine-Computation-Profile X-Earth-Engine-Computation-Profiling X-Play-Console-Experiments-Override X-Play-Console-Session-Id x-alkali-account-key x-alkali-application-key x-alkali-auth-apps-namespace x-alkali-auth-entities-namespace x-alkali-auth-entity x-alkali-client-locale EES-S7E-MODE cast-device-capabilities X-Server-Timeout x-foyer-client-environment x-goog-greenenergyuserappservice-metadata x-goog-sherlog-context X-Server-Token X-WebChannel-Content-Type x-rfui-request-context X-Workflow-Client x-goog-nest-jwt X-Cloud-Trace-Context traceparent x-goog-chat-space-id x-goog-pan-request-context X-AppInt-Credentials X-Iceberg-Access-Delegation x-goog-firestore-api-requester x-Goog-Ws-AgentId Access-Control-Allow-Methods: GET HEAD OPTIONS Accept-Ranges: bytes Content-Length: 318992 Last-Modified: Fri 19 Jun 2026 10:51:45 GMT Date: Tue 07 Jul 2026 08:53:31 GMT Expires: Tue 07 Jul 2026 08:53:31 GMT Cache-Control: private max-age=0 X-Goog-Hash: crc32c=ZgAmOQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>44C2B132C2ACC2823D690E6FC2995157C2B4C3BEC29F30241C721F661AC2BFC2AB0EC390C2BDC3A571C2B92AC3AEC3931CC2B0C28973C39EC2851C5446C38DC2....... "GET /uc?export=download&id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Host: drive.google.com Cache-Control: no-cache" Response ==> HTTP/1.1 303 See Other Content-Type: application/binary Vary: Origin Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Tue 07 Jul 2026 08:53:33 GMT Location: https://drive.usercontent.google.com/download?id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-XuobsMWQmtC29ccwDtm3ow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "GET /download?id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream X-GUploader-UploadID: AJ5rDhGsMS2xLv1M-LYBoMJpzXDp4b_0EnESizsVNgcjGLZk8ZUGEoMX8dmw0kmynVQiTu1-afQfp_E Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="agent.log" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept Accept-Language Authorization Cache-Control Content-Disposition Content-Encoding Content-Language Content-Length Content-MD5 Content-Range Content-Type Date developer-token financial-institution-id X-Goog-Sn-Metadata X-Goog-Sn-PatientId GData-Version google-cloud-resource-prefix linked-customer-id login-customer-id login-account linked-account x-goog-request-params Host If-Match If-Modified-Since If-None-Match If-Unmodified-Since Origin OriginToken Pragma Range request-id Signature Signature-Agent Signature-Input Slug Transfer-Encoding User-Agent hotrod-board-name hotrod-chrome-cpu-model hotrod-chrome-processors Want-Digest X-Ad-Manager-Impersonation x-chrome-connected X-ClientDetails X-Client-Pctx X-Client-Version x-debug-settings-metadata X-Firebase-AppId X-Firebase-AppVersion X-Firebase-Locale X-Goog-Firebase-Installations-Auth X-Firebase-Client X-Firebase-Client-Log-Type X-Firebase-GMPID X-Firebase-Auth-Token X-Firebase-AppCheck X-Firebase-RC-Fetch-Type X-Firebase-Token X-Goog-Drive-Client-Version X-Goog-Drive-Resource-Keys X-GData-Client X-GData-Key X-GoogApps-Allowed-Domains X-Goog-AdX-Buyer-Impersonation X-Goog-Api-Client X-Goog-Visibilities X-Goog-AuthUser X-Google-EOM x-goog-ext-124712974-jspb x-goog-ext-467253834-jspb x-goog-ext-353267353-bin x-goog-ext-353267353-jspb x-goog-ext-251363160-jspb X-Restricted-Content-Limit x-goog-ext-259736195-jspb x-goog-ext-477772811-jspb x-goog-ext-359275022-bin x-goog-ext-328800237-jspb x-goog-ext-198889211-bin x-goog-ext-202735639-bin x-goog-ext-223261916-bin x-goog-ext-223435598-bin x-goog-ext-233818517-bin x-goog-ext-202964622-bin X-Goog-PageId X-Goog-Encode-Response-If-Executable X-Goog-Correlation-Id X-Goog-Request-Info X-Goog-Request-Reason X-Goog-Request-Time X-Goog-Experiments x-goog-iam-authority-selector x-goog-iam-authorization-token X-Goog-Spatula X-Goog-Travel-Bgr X-Goog-Travel-Settings X-Goog-Upload-Command X-Goog-Upload-Content-Disposition X-Goog-Upload-Content-Length X-Goog-Upload-Content-Type X-Goog-Upload-File-Name X-Goog-Upload-Header-Content-Encoding X-Goog-Upload-Header-Content-Length X-Goog-Upload-Header-Content-Type X-Goog-Upload-Header-Transfer-Encoding X-Goog-Upload-Offset X-Goog-Upload-Protocol x-goog-user-project X-Goog-Visitor-Id X-Goog-FieldMask X-Google-Project-Override x-goog-maps-api-salt x-goog-maps-api-signature x-goog-maps-client-id X-Goog-Api-Key x-goog-spanner-database-role X-HTTP-Method-Override X-JavaScript-User-Agent X-Pan-Versionid X-Proxied-User-IP X-Origin X-Referer X-Requested-With X-Stadia-Client-Context X-Upload-Content-Length X-Upload-Content-Type X-Use-Alt-Service X-Use-HTTP-Status-Code-Override X-Ios-Bundle-Identifier X-Places-Ios-Sdk X-Android-Package X-Android-Cert X-Places-Android-Sdk X-Goog-Maps-Ios-Uuid X-Goog-Maps-Android-Uuid X-Ariane-Xsrf-Token X-A2A-Extensions X-YouTube-Bootstrap-Logged-In X-Youtube-Client-Name X-Youtube-Client-Version X-Youtube-Finch-Config-Data X-Youtube-Finch-Hash-Data X-YouTube-Lava-Device-Context X-YouTube-VVT X-YouTube-Page-CL X-YouTube-Page-Label X-YouTube-Page-Timestamp X-Compass-Routing-Destination x-framework-xsrf-token X-Goog-Meeting-ABR X-Goog-Meeting-Botguardid X-Goog-Meeting-Bot-Info X-Goog-Meeting-ClientInfo X-Goog-Meeting-ClientVersion X-Goog-Meeting-Debugid X-Goog-Meeting-Identifier X-Goog-Meeting-Interop-Cohorts X-Goog-Meeting-Interop-Type X-Goog-Meeting-OidcIdToken X-Goog-Meeting-RtcClient X-Goog-Meeting-StartSource X-Goog-Meeting-Token X-Goog-Meeting-Viewer-Token X-Goog-Healthcare-Audit-First-Party-Application-Access Prefer X-Client-Data x-sdm-id-token X-Sfdc-Authorization MIME-Version Content-Transfer-Encoding X-Earth-Engine-App-ID-Token X-Earth-Engine-Computation-Profile X-Earth-Engine-Computation-Profiling X-Play-Console-Experiments-Override X-Play-Console-Session-Id x-alkali-account-key x-alkali-application-key x-alkali-auth-apps-namespace x-alkali-auth-entities-namespace x-alkali-auth-entity x-alkali-client-locale EES-S7E-MODE cast-device-capabilities X-Server-Timeout x-foyer-client-environment x-goog-greenenergyuserappservice-metadata x-goog-sherlog-context X-Server-Token X-WebChannel-Content-Type x-rfui-request-context X-Workflow-Client x-goog-nest-jwt X-Cloud-Trace-Context traceparent x-goog-chat-space-id x-goog-pan-request-context X-AppInt-Credentials X-Iceberg-Access-Delegation x-goog-firestore-api-requester x-Goog-Ws-AgentId Access-Control-Allow-Methods: GET HEAD OPTIONS Accept-Ranges: bytes Content-Length: 3484320 Last-Modified: Mon 04 May 2026 13:19:07 GMT Date: Tue 07 Jul 2026 08:53:35 GMT Expires: Tue 07 Jul 2026 08:53:35 GMT Cache-Control: private max-age=0 X-Goog-Hash: crc32c=Ri1sEw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>2807C3AE447FC2A2160F0057C3A74AC29DC3AFC3B0C28AC29C1248C3B42D72C2A521C29FC28BC38E5B1C363739C385242E1376C39C72C2AA4B5877C297C28A03....... "GET /uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Host: drive.google.com Cache-Control: no-cache" Response ==> HTTP/1.1 303 See Other Content-Type: application/binary Vary: Origin Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Tue 07 Jul 2026 08:53:37 GMT Location: https://drive.usercontent.google.com/download?id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-RjDKEzZascSsio17sOAQlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "GET /download?id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream X-GUploader-UploadID: AJ5rDhGjJimZxsyTDUaaEbs8efGZut8lSzAn1tJoQ25_ipNkgJqvPRyOSX78_9LZZGaqOKHKBI7xnkg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="msh.log" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept Accept-Language Authorization Cache-Control Content-Disposition Content-Encoding Content-Language Content-Length Content-MD5 Content-Range Content-Type Date developer-token financial-institution-id X-Goog-Sn-Metadata X-Goog-Sn-PatientId GData-Version google-cloud-resource-prefix linked-customer-id login-customer-id login-account linked-account x-goog-request-params Host If-Match If-Modified-Since If-None-Match If-Unmodified-Since Origin OriginToken Pragma Range request-id Signature Signature-Agent Signature-Input Slug Transfer-Encoding User-Agent hotrod-board-name hotrod-chrome-cpu-model hotrod-chrome-processors Want-Digest X-Ad-Manager-Impersonation x-chrome-connected X-ClientDetails X-Client-Pctx X-Client-Version x-debug-settings-metadata X-Firebase-AppId X-Firebase-AppVersion X-Firebase-Locale X-Goog-Firebase-Installations-Auth X-Firebase-Client X-Firebase-Client-Log-Type X-Firebase-GMPID X-Firebase-Auth-Token X-Firebase-AppCheck X-Firebase-RC-Fetch-Type X-Firebase-Token X-Goog-Drive-Client-Version X-Goog-Drive-Resource-Keys X-GData-Client X-GData-Key X-GoogApps-Allowed-Domains X-Goog-AdX-Buyer-Impersonation X-Goog-Api-Client X-Goog-Visibilities X-Goog-AuthUser X-Google-EOM x-goog-ext-124712974-jspb x-goog-ext-467253834-jspb x-goog-ext-353267353-bin x-goog-ext-353267353-jspb x-goog-ext-251363160-jspb X-Restricted-Content-Limit x-goog-ext-259736195-jspb x-goog-ext-477772811-jspb x-goog-ext-359275022-bin x-goog-ext-328800237-jspb x-goog-ext-198889211-bin x-goog-ext-202735639-bin x-goog-ext-223261916-bin x-goog-ext-223435598-bin x-goog-ext-233818517-bin x-goog-ext-202964622-bin X-Goog-PageId X-Goog-Encode-Response-If-Executable X-Goog-Correlation-Id X-Goog-Request-Info X-Goog-Request-Reason X-Goog-Request-Time X-Goog-Experiments x-goog-iam-authority-selector x-goog-iam-authorization-token X-Goog-Spatula X-Goog-Travel-Bgr X-Goog-Travel-Settings X-Goog-Upload-Command X-Goog-Upload-Content-Disposition X-Goog-Upload-Content-Length X-Goog-Upload-Content-Type X-Goog-Upload-File-Name X-Goog-Upload-Header-Content-Encoding X-Goog-Upload-Header-Content-Length X-Goog-Upload-Header-Content-Type X-Goog-Upload-Header-Transfer-Encoding X-Goog-Upload-Offset X-Goog-Upload-Protocol x-goog-user-project X-Goog-Visitor-Id X-Goog-FieldMask X-Google-Project-Override x-goog-maps-api-salt x-goog-maps-api-signature x-goog-maps-client-id X-Goog-Api-Key x-goog-spanner-database-role X-HTTP-Method-Override X-JavaScript-User-Agent X-Pan-Versionid X-Proxied-User-IP X-Origin X-Referer X-Requested-With X-Stadia-Client-Context X-Upload-Content-Length X-Upload-Content-Type X-Use-Alt-Service X-Use-HTTP-Status-Code-Override X-Ios-Bundle-Identifier X-Places-Ios-Sdk X-Android-Package X-Android-Cert X-Places-Android-Sdk X-Goog-Maps-Ios-Uuid X-Goog-Maps-Android-Uuid X-Ariane-Xsrf-Token X-A2A-Extensions X-YouTube-Bootstrap-Logged-In X-Youtube-Client-Name X-Youtube-Client-Version X-Youtube-Finch-Config-Data X-Youtube-Finch-Hash-Data X-YouTube-Lava-Device-Context X-YouTube-VVT X-YouTube-Page-CL X-YouTube-Page-Label X-YouTube-Page-Timestamp X-Compass-Routing-Destination x-framework-xsrf-token X-Goog-Meeting-ABR X-Goog-Meeting-Botguardid X-Goog-Meeting-Bot-Info X-Goog-Meeting-ClientInfo X-Goog-Meeting-ClientVersion X-Goog-Meeting-Debugid X-Goog-Meeting-Identifier X-Goog-Meeting-Interop-Cohorts X-Goog-Meeting-Interop-Type X-Goog-Meeting-OidcIdToken X-Goog-Meeting-RtcClient X-Goog-Meeting-StartSource X-Goog-Meeting-Token X-Goog-Meeting-Viewer-Token X-Goog-Healthcare-Audit-First-Party-Application-Access Prefer X-Client-Data x-sdm-id-token X-Sfdc-Authorization MIME-Version Content-Transfer-Encoding X-Earth-Engine-App-ID-Token X-Earth-Engine-Computation-Profile X-Earth-Engine-Computation-Profiling X-Play-Console-Experiments-Override X-Play-Console-Session-Id x-alkali-account-key x-alkali-application-key x-alkali-auth-apps-namespace x-alkali-auth-entities-namespace x-alkali-auth-entity x-alkali-client-locale EES-S7E-MODE cast-device-capabilities X-Server-Timeout x-foyer-client-environment x-goog-greenenergyuserappservice-metadata x-goog-sherlog-context X-Server-Token X-WebChannel-Content-Type x-rfui-request-context X-Workflow-Client x-goog-nest-jwt X-Cloud-Trace-Context traceparent x-goog-chat-space-id x-goog-pan-request-context X-AppInt-Credentials X-Iceberg-Access-Delegation x-goog-firestore-api-requester x-Goog-Ws-AgentId Access-Control-Allow-Methods: GET HEAD OPTIONS Accept-Ranges: bytes Content-Length: 35963 Last-Modified: Wed 24 Jun 2026 03:58:04 GMT Date: Tue 07 Jul 2026 08:53:38 GMT Expires: Tue 07 Jul 2026 08:53:38 GMT Cache-Control: private max-age=0 X-Goog-Hash: crc32c=eNq2zg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>77C3A1C3A2C395C28C39C396C28543C2971CC2B8C38B2B07C2BAC2B3C28AC38E3EC29BC2AF5BC399C383C2AAC3A35CC283751FC388C3B37225C2A304C3816DC2.......3b:Ta52,"rundll32.exe" loaded module "KERNEL32" at base 7ffc09c70000 "rundll32.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc09030000 "rundll32.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc09030000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc09030000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc0a9e0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc09030000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc09030000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc09030000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbf39d0000 "rundll32.exe" loaded module "C:\943E3D0534EB4EE6401CDD060BC35EDA394757457F1F1BBC5542D93C5901B4D1.BIN.DLL" at base 7ffbf03b0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc06cd0000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 7ffc09c70000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 7ffc0a460000 "rundll32.exe" loaded module "SSPICLI.DLL" at base 7ffc085c0000 "rundll32.exe" loaded module "USER32.DLL" at base 7ffc09d90000 "rundll32.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ffbea430000 "rundll32.exe" loaded module "WINHTTP.DLL" at base 7ffc04ef0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffbea430000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc07f20000 "rundll32.exe" loaded module "MSISO.DLL" at base 7ffbf6140000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc012c0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc01820000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 7ffc09d20000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffc07a70000 "rundll32.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffbf9f20000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffc09530000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc07b30000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc093f0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffbe7c10000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffc09640000 "rundll32.exe" loaded module "CRYPTNET.DLL" at base 7ffbe7c10000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffbfa200000 "rundll32.exe" loaded module "NTDLL.DLL" at base 7ffc0c3400003c:T42f,"943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000aefd,call 0x180014414,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000adc0,int3 ,int3 ,int3 ,lea rax, [rip + 0x1f55d],ret ,push rbx,sub rsp, 0x20,mov eax, dword ptr [rip + 0x23a10],mov ebx, 0x14,test eax, eax,jne 0x18000af40,mov eax, 0x200,jmp 0x18000af45," "Taskmgr.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140005dd0,add rsp, 0x28,jmp 0x14000526c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0xd69d1],jne 0x140005519,rol rcx, 0x10,test cx, 0xffff,jne 0x140005515,ret ,ror rcx, 0x10,jmp 0x140005560,jmp qword ptr [rip + 0xa3ccc],push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,"3d:T7b7,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER"; Key: ""; Value: "")3e:T7b2,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID"; Value: "")3f:T406,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Able to perform sandbox evasion using APIs Matched sigs: Contains ability to delay the execution of current thread40:T46e,"rundll32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "rundll32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "rundll32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "rundll32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\app64[1].log" "rundll32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\agent[1].log" "rundll32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\msh[1].log" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\app64[1].log" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\agent[1].log" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\msh[1].log"41:T1012,Found string "https://drive.google.com/uc?export=download&id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc" (Indicator: "drive.google.com"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found string "https://drive.google.com/uc?export=download&id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr" (Indicator: "drive.google.com"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found string "https://drive.google.com/uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m" (Indicator: "drive.google.com"; File: "943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin") Found string "drive.google.com" (Indicator: "drive.google.com"; File: "PCAP") Found string "GET /uc?export=download&id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" (Indicator: "drive.google.com"; File: "PCAP") Found string "GET /uc?export=download&id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" (Indicator: "drive.google.com"; File: "PCAP") Found string "GET /uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Host: drive.google.comCache-Control: no-cache" (Indicator: "drive.google.com"; File: "PCAP") Found string "https://drive.google.com/uc?export=download&id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.F03D0000.00000002.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "ttps://drive.google.com/" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "drive.google.com" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "ttps://drive.google.com/uc?export=download&id=1EkyeoSdhvGqcEpZkqBUzXnJYPLka7zJc" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "drive.google.com0" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp, 00000000-00000696.00000000.169694.28BC0000.00000004.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp, 00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found string "https://drive.google.com/uc?export=download&id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "https://drive.google.com/uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp, 00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "https://drive.google.com/" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "ttps://drive.google.com/uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "ttps://drive.google.com/uc?export=download&id=1rqN7zYXO0jNSsZy8gSECxSxY57T0T_xr" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found string "Hostdrive.google.comGET /uc?export=download&id=176jQJH3H3DHPzjFI-tIjrV8KLtEBgY_m HTTP/1.17" (Indicator: "drive.google.com"; Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp")42:T23eb,Pattern match: "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc" Pattern match: "https://drive.google.com/uc?export=download&id=1rqn7zyxo0jnsszy8gsecxsxy57t0t_xr" Pattern match: "https://drive.google.com/uc?export=download&id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m" Pattern match: "ga3.efly/o[2%bxhwe\64z%tkrpb" Heuristic match: "drive.google.com" Heuristic match: "drive.usercontent.google.com" Heuristic match: "rive.google.com" Heuristic match: "oogle.com" Heuristic match: "google.com" Pattern match: "drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc" Pattern match: "e.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc" Pattern match: "drive.usercontent.google.com/download?id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc&export=download" Heuristic match: "rive.usercontent.google.com" Heuristic match: "ntrust.net" Heuristic match: "nt.google.com" Heuristic match: ".usercontent.google.com" Heuristic match: "*.google.com" Heuristic match: "*.appengine.google.com" Heuristic match: "*.cloud.google.com" Heuristic match: "*.crowdsource.google.com" Heuristic match: "*.datacompute.google.com" Heuristic match: "*.google.ca" Heuristic match: "*.google.cl" Heuristic match: "*.google.co.in" Heuristic match: "*.google.co.jp" Heuristic match: "*.google.co.uk" Heuristic match: "*.google.com.ar" Heuristic match: "*.google.com.au" Heuristic match: "*.google.com.br" Heuristic match: "*.google.com.co" Heuristic match: "*.google.com.mx" Heuristic match: "*.google.com.tr" Heuristic match: "*.google.com.vn" Heuristic match: "*.google.de" Heuristic match: "*.google.es" Heuristic match: "*.google.fr" Heuristic match: "*.google.hu" Heuristic match: "*.google.it" Heuristic match: "*.google.nl" Heuristic match: "*.google.pl" Heuristic match: "*.google.pt" Heuristic match: "*.gemini.cloud.google.com" Heuristic match: "*.gstatic.com" Heuristic match: "*.metric.gstatic.com" Heuristic match: "*.gvt1.com" Heuristic match: "*.gcpcdn.gvt1.com" Heuristic match: "*.gvt2.com" Heuristic match: "*.gcp.gvt2.com" Heuristic match: "*.url.google.com" Heuristic match: "*.youtube-nocookie.com" Heuristic match: "*.ytimg.com" Heuristic match: "android.com" Heuristic match: "*.android.com" Heuristic match: "*.flash.android.com" Heuristic match: "*.g.co" Heuristic match: "goo.gl" Pattern match: "www.goo.gl" Heuristic match: "google-analytics.com" Heuristic match: "*.google-analytics.com" Heuristic match: "googlecommerce.com" Heuristic match: "*.googlecommerce.com" Heuristic match: "urchin.com" Heuristic match: "*.urchin.com" Heuristic match: "youtu.be" Heuristic match: "youtube.com" Heuristic match: "*.youtube.com" Heuristic match: "music.youtube.com" Heuristic match: "*.music.youtube.com" Heuristic match: "youtubeeducation.com" Heuristic match: "*.youtubeeducation.com" Heuristic match: "youtubekids.com" Heuristic match: "*.youtubekids.com" Heuristic match: "yt.be" Heuristic match: "*.yt.be" Heuristic match: "android.clients.google.com" Heuristic match: "*.aistudio.google.com" Heuristic match: "*.usercontent.google.com" Heuristic match: "usercontent.google.com" Heuristic match: "*.usercontent.sandbox.google.com" Heuristic match: "fife.google.com" Heuristic match: "*.fife.google.com" Heuristic match: "fife.usercontent.google.com" Heuristic match: "*.fife.usercontent.google.com" Heuristic match: "usercontent.youtube.com" Heuristic match: "*.usercontent.youtube.com" Heuristic match: "$lti.workspace.usercontent.google.com" Heuristic match: "lti.drive.usercontent.google.com" Heuristic match: "!lti.gemini.usercontent.google.com" Heuristic match: "lti.meet.usercontent.google.com" Pattern match: "https://drive.usercontent.google.com/" Heuristic match: "host: drive.usercontent.google.com" Pattern match: "https://drive.usercontent.google.com/download?id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc&export=download" Pattern match: "https://apis.google.com" Pattern match: "ercontent.google.com/download?id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc&export=download" Heuristic match: "gle.com" Heuristic match: "nt.google.co" Heuristic match: "t.google.com" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Heuristic match: "e1mpymcb.com" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "vices.cr" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "9d.mr" Pattern match: "https://drive.google.com/" Pattern match: "drive.google.com/uc?export=download&id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m" Pattern match: "drive.google.com/uc?export=download&id=1rqn7zyxo0jnsszy8gsecxsxy57t0t_xr" Pattern match: "drive.usercontent.google.com/download?id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m&export=download" Pattern match: "drive.usercontent.google.com/download?id=1rqn7zyxo0jnsszy8gsecxsxy57t0t_xr&export=download" Heuristic match: "content.google.com" Heuristic match: "package_984_for_kb4074588~31bf3856ad364e35~amd64~~10.0.1.17.cat" Heuristic match: "cs.com" Pattern match: "https://drive.usercontent.google.com/download?id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m&export=download" Pattern match: "ercontent.google.com/download?id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m&export=download" Heuristic match: "ogle.com" Pattern match: "https://drive.usercontent.google.com/download?id=1rqn7zyxo0jnsszy8gsecxsxy57t0t_xr&export=download"43:T5bc2,Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjchine\so%systemroot%\system32\nlasvc.dll,-1000%systemroot%\system32\pnrpnsp.dll,-1001%systemroot%\system32\pnrpnsp.dll,-1000%systemroot%\system32\napinsp.dll,-1000%systemroot%\system32\wshtcpip.dll,-60103%systemroot%\system32\winrnr.dll,-1000hyper-v" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjctk&,tk&,0uk&,0uk&," - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjcso&,'r&,nk&,nk&,https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/'n&,hjo&,hjo&,pao&,pao&,ao&,ao&,pbo&,pbo&,08r&,1i&,bo&,bo&,asycwn&,qn&,asyc0" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc&export=downloadstrict-transport-security:" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://apis.google.com" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://ssl.gstatic.com" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://www.googletagmanager.com" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://www.gstatic.com" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://www.google-analytics.com;report-uri" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsuuuhhsmookhx" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;gr&,rn&,*.yt.belt&,0fs&," - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl08s&,eris" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszys%t&,>t&,>t&,il" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l/w&,/w&,/w&,/w&,/w&,/w&,0w&,'0w&,;0w&,o0w&,c0w&,w0w&,0w&,0w&,0w&,0w&,0w&,0w&,1w&,1w&,+1w&,?1w&,s1w&,g1w&," - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc&export=downloads://d?id" - Source: "00000000-00000696.00000000.169694.26490000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "https://apis.google.com" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "https://ssl.gstatic.com" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "https://www.googletagmanager.com" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "https://www.gstatic.com" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "https://www.google-analytics.com;report-uri" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc&export=downloadnzw&" - Source: "00000000-00000696.00000000.169694.28BC0000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc\google\chrome\application\chrome.exe\microsoft\edge\application\msedge.exe\taskmgr.exe%s\temp\taskmgr.exe%s\temp\taskmgr.msh%s\remhttps://drive.google.com/uc?export=download&id=1rqn7zyxo0jnsszy8gsecxsxy57t0t_xrhttps://drive.google.com/uc?export=download&id=176jqjh3h3dhpzjfi-tijrv8kltebgy_mtarget" - Source: "00000000-00000696.00000000.169694.F03D0000.00000002.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjchine\so%systemroot%\system32\nlasvc.dll,-1000%systemroot%\system32\pnrpnsp.dll,-1001%systemroot%\system32\pnrpnsp.dll,-1000%systemroot%\system32\napinsp.dll,-1000%systemroot%\system32\wshtcpip.dll,-60103%systemroot%\system32\winrnr.dll,-1000hyper-v" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://drive.google.com/drive.google.comoftware\policies\microsoft\systemcertificates\caindows" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjctk&,tk&,0uk&,0uk&," - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjcso&,'r&,nk&,nk&,https://drive.google.com/uc?export=download&id=1ekyeosdhvgqcepzkqbuzxnjyplka7zjc" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m&export=downloadstrict-transport-security:" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://apis.google.com" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://ssl.gstatic.com" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://www.googletagmanager.com" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://www.gstatic.com" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://www.google-analytics.com;report-uri" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsuuuhhsmookhx" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;gr&,qt&,lt&,0fs&," - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl08s&,eris" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszys%t&,>t&,>t&,il" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l/w&,/w&,/w&,/w&,/w&,/w&,0w&,'0w&,;0w&,o0w&,c0w&,w0w&,0w&,0w&,0w&,0w&,0w&,0w&,1w&,1w&,+1w&,?1w&,s1w&,g1w&," - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m&export=download1x&,0^q&,https://drive.usercontent.google.com/download?id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m&export=download:x&,0rq&,8x&,05x&,dx&,dx&,timevaliddllflushobjects://d?id" - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m/x&,gx&," - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1rqn7zyxo0jnsszy8gsecxsxy57t0t_xrhttps://drive.google.com/uc?export=download&id=176jqjh3h3dhpzjfi-tijrv8kltebgy_mex&,ex&," - Source: "00000000-00000696.00000001.170068.26490000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "https://apis.google.com" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "https://ssl.gstatic.com" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "https://www.googletagmanager.com" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "https://www.gstatic.com" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "https://www.google-analytics.com;report-uri" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m&export=downloadstrict-transport-security:" - Source: "00000000-00000696.00000001.170068.28BC0000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=176jqjh3h3dhpzjfi-tijrv8kltebgy_m&export=downloadhttps://drive.usercontent.google.com/download?id=1rqn7zyxo0jnsszy8gsecxsxy57t0t_xr&export=download6]ghd6c_hwcujh7x&u","command_line":"","normalized_path":"","uid":"00000000-00006088"},{"pid":696,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin.dll\",#1","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00000696","icon":"$54"},{"pid":6780,"ppid":696,"name":"chrome.exe","command_line":"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000696","uid":"00000000-00006780"},{"pid":7748,"ppid":696,"name":"msedge.exe","command_line":"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000696","uid":"00000000-00007748"}],"all_imported_dlls":["msIso.dll","combase.dll","SHCore.dll","cryptnet.dll","cfgmgr32.dll","msvcrt.dll","wininet.dll","crypt32.dll","msasn1.dll","ncrypt.dll","bcryptprimitives.dll","cryptsp.dll","OnDemandConnRouteHelper.dll","winnsi.dll","mskeyprotect.dll","clbcatq.dll","sxs.dll","dwmapi.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","schannel.dll","fltLib.dll","imagehlp.dll","VxSSL64.dll","sspicli.dll","winhttp.dll","ntasn1.dll","oleaut32.dll","imm32.dll","gpapi.dll","gdi32.dll","ncryptsslp.dll","version.dll","gdi32full.dll","advapi32.dll","windows.storage.dll","powrprof.dll","uxtheme.dll","kernel32.dll","KernelBase.dll","ucrtbase.dll","iertutil.dll","urlmon.dll","win32u.dll","shlwapi.dll","msctf.dll","dpapi.dll","ntdll.dll","rpcrt4.dll","dnsapi.dll","rsaenh.dll","sechost.dll","mswsock.dll","wintrust.dll","ntmarta.dll","nsi.dll","rasadhlp.dll","943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1.bin.dll","shell32.dll","msvcp_win.dll","ws2_32.dll","kernel.appcore.dll","profapi.dll","cryptbase.dll","bcrypt.dll","user32.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Taskmgr.exe","sha256":"09459f012f42eaed788f617c3c879d298077dca193b239b1172628a5e0c3ffaa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"agent_1_.log","sha256":"fbbf6c23bb48e0f178c5097483b92459c9288e9b08e9733fe6f31e861fb43bff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"app","sha256":"c1aa93ac4c11a1ca5fdfd97c476bc7000225dec16bbcfd7f9813f1defaa7e27a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"rem","sha256":"fbbf6c23bb48e0f178c5097483b92459c9288e9b08e9733fe6f31e861fb43bff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"Taskmgr.msh","sha256":"d9f19f2d4823435de6ee295900060235dc0acc7baa4472ca47f14ce9795b5258","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"msh_1_.log","sha256":"cff089d25382aa02a745a214448ee42c5dfa3df5fab806515acbb30f5e6394df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"app64_1_.log","sha256":"c1aa93ac4c11a1ca5fdfd97c476bc7000225dec16bbcfd7f9813f1defaa7e27a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\app64[1].log","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%LOCALAPPDATA%\\app","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\agent[1].log","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%LOCALAPPDATA%\\rem","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\msh[1].log","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%TEMP%\\Taskmgr.msh","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"path":"%TEMP%\\Taskmgr.exe","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"Local\\SM0:696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"SM0:696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"SM0:696:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:696:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a4cbe715fa3339a190f05ba"}]}]}},"report_ids":{"sandbox_job_ids":["6a4cbe715fa3339a190f05ba"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 943e3d0534eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 943e3d0534eb…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 4/27 AV engines flagged this file. 3 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 943e3d0534eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 943e3d0534eb…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 4/27 AV engines flagged this file. 3 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/943e3d0534eb4ee6401cdd060bc35eda394757457f1f1bbc5542d93c5901b4d1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 943e3d0534eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 943e3d0534eb…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 4/27 AV engines flagged this file. 3 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L55","11",{}]]