26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 80:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample cdc58e74d07a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cdc58e74d07a…. Malware family: Trojan.Generic. Threat score 100/100. 2/24 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["compressed","innosetup"],"identifier":"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":2,"total":24},"behavioralIndicators":{"malicious":4,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5bc,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")28:Te19,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")29:T89e,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000000.190332.04810000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")2a:Tb23,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TYPELIBINDEX") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN32")2b:Tf68,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-1926374409 [PID: 8152] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-1926383218 [PID: 8152] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-1926536306 [PID: 8152] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-1926545907 [PID: 8152] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-1926651738 [PID: 8152] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-1926660539 [PID: 8152] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-1926790037 [PID: 8152] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-1926798433 [PID: 8152] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00000696-00000C15-1927716223 [PID: 696] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00000696-00000C15-1927724746 [PID: 696] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00000696-00000C15-1928120943 [PID: 696] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00000696-00000C15-1928130143 [PID: 696] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00003952-00000C15-1969739687 [PID: 3952] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00003952-00000C15-1969748421 [PID: 3952] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00003952-00000C15-1969900769 [PID: 3952] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00003952-00000C15-1969908066 [PID: 3952] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00003952-00000C15-1969997832 [PID: 3952] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00003952-00000C15-1970004996 [PID: 3952] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00003952-00000C15-1970127866 [PID: 3952] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" queried SystemProcessInformation at 00000000-00003952-00000C15-1970135872 [PID: 3952] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00004864-00000C15-1970889623 [PID: 4864] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00004864-00000C15-1970898414 [PID: 4864] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00004864-00000C15-1971278031 [PID: 4864] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00004864-00000C15-1971287212 [PID: 4864] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" queried SystemProcessInformation at 00000000-00004864-00000C15-1973062898 [PID: 4864]2c:T465,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" renamed original file"C:\ProgramData\VioletPink\is-TI0PC5YQ7W.tmp" to "%ALLUSERSPROFILE%\VioletPink\FnHotkeyUtility.exe" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" renamed original file"C:\ProgramData\VioletPink\is-NP4K53KHHN.tmp" to "%ALLUSERSPROFILE%\VioletPink\ludp.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" renamed original file"C:\ProgramData\VioletPink\is-UX3ZV8ZHNE.tmp" to "%ALLUSERSPROFILE%\VioletPink\msvcp140.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" renamed original file"C:\ProgramData\VioletPink\is-2B1Z04HMIV.tmp" to "%ALLUSERSPROFILE%\VioletPink\spkvol.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" renamed original file"C:\ProgramData\VioletPink\is-U2E6XUOJW4.tmp" to "%ALLUSERSPROFILE%\VioletPink\vcruntime140.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" renamed original file"C:\ProgramData\VioletPink\is-19PT4BDO01.tmp" to "%ALLUSERSPROFILE%\VioletPink\vcruntime140_1.dll"2d:T12e1,Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertFindChainInStore" (Indicator: "CertFindChainInStore"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00003952.00000000.190332.006F0000.00000004.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp")2e:T6bd3,Contains base64 string in header "/sg/msn/1/cm" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "222166F75FD3671F181970045E3D66DC" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "microsoftSsp" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "true" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "linkedin" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "1391f723" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "91e0" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "4064" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8cb8" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "08df8de6ce67" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Priority" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"2f:Tc8a6,Found XOR loop in file "_isdecmp.dll" at offset 23985; code bytes = 30d0 Found XOR loop in file "_isdecmp.dll" at offset 26548; code bytes = 30d0 Found XOR loop in file "_isdecmp.dll" at offset 31004; code bytes = 30d0 Found XOR loop in file "_isdecmp.dll" at offset 34710; code bytes = 30d0 Found XOR loop in file "_isdecmp.dll" at offset 21811; code bytes = 8030 Found XOR loop in file "_isdecmp.dll" at offset 29612; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 6711; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 52677; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 71405; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 98888; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 99098; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 100184; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 229074; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 274567; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 281422; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 292433; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 296900; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 420823; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 428179; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 506580; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 755048; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 779414; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 797700; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 829108; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 841962; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 933057; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 940142; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 940173; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1029961; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1058688; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1238098; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1313940; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1339240; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1365817; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1378420; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1382050; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1391515; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1456782; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1478074; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1534450; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1553716; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1606286; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1649902; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1669789; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1732154; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1939032; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1941361; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1952103; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 2048339; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 2089190; code bytes = 30d0 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 16317; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 24337; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 81184; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 104086; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 219392; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 262827; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 307206; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 474109; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 487820; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 492978; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 537782; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 633584; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 703030; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 731883; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 819067; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 895568; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 895793; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 901187; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1320763; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1347234; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1428830; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1468426; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1609650; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1632340; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1715970; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1734682; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1821729; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1956174; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1999150; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 2095504; code bytes = 33c1 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 2322; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 307528; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 372346; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 396810; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 553725; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 691871; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 701816; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 790652; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 872505; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1068868; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1129133; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1271524; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1304098; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1315999; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1344740; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1399263; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1443974; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1704155; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1746573; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1791364; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1908471; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1942674; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1972067; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 1985126; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 2072247; code bytes = 8030 Found XOR loop in file "is-2B1Z04HMIV.tmp" at offset 2102945; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 27779; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 27794; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 27802; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 32649; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3166901; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3166960; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3166968; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3166979; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3172401; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3651324; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3655472; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3698984; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3700459; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3893252; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3922915; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3924367; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3925323; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3931541; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3932879; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3933045; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3939635; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3940329; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3942859; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3952387; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3959779; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3961037; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3972389; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3975797; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3983617; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3987071; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3990937; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4002193; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4006789; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4011773; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4018027; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4022167; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4025633; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4026371; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4035343; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4036067; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4044199; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4049113; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4058659; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4062327; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4063551; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4064555; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4065659; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4066177; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4067267; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4077999; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4083631; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4094553; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4105507; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4117267; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4117889; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4122363; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4123011; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4128199; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4131875; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4133441; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4138789; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4139379; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4148999; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4153465; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4155667; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4157685; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4158403; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4160923; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4161635; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4164607; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4170849; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4171587; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4182451; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4186075; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4187279; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4188575; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4190657; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4191071; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4191789; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4199459; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4205405; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4207011; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4209051; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4211103; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4213123; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4215127; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4217159; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4219175; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4221081; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4224815; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4226135; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4228227; code bytes = 30d0 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3123539; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3123572; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3123605; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3123638; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3123801; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3124043; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3192001; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3926239; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3939005; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3956099; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3961825; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3962555; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3988267; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4002303; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4013729; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4017031; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4017529; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4025199; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4025723; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4058823; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4063637; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4087955; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4104497; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4113959; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4122459; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4124945; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4144481; code bytes = 33c1 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 2948293; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 2970549; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 2983733; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3017542; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3027916; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3051755; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3283153; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3283171; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3339946; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3340311; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3402942; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3404540; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3404570; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3404590; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3463807; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3463870; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3463907; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3463925; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3464256; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3464274; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3471557; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3567988; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3916306; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3916846; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3918936; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3922896; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3923710; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3925310; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3927982; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3932178; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3935608; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3938296; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3939600; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3941774; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3942822; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3945012; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3951070; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3951406; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3959752; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3962382; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3967208; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3969310; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3971826; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3989444; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3990018; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3995004; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3996380; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3998582; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 3999624; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4000600; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4010532; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4011144; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4021192; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4023382; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4026332; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4028040; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4035304; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4036028; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4044168; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4053204; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4056760; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4058620; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4064544; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4065056; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4072324; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4079568; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4083620; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4085890; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4086556; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4099344; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4102586; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4105472; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4107632; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4110860; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4112902; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4113604; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4122344; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4128658; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4131086; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4148960; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4149518; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4152008; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4155628; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4158364; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4160884; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4166089; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4176112; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4185760; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4191032; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4191760; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4192340; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4193502; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4203242; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4206972; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4209012; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4211064; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4213084; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4215088; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4217120; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4219142; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4223996; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4224776; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4226116; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4228188; code bytes = 8030 Found XOR loop in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" at offset 4230339; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 585225; code bytes = 30d0 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 585328; code bytes = 30d0 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1493232; code bytes = 30d0 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1493264; code bytes = 30d0 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1493280; code bytes = 30d0 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1624628; code bytes = 30d0 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 226432; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 226437; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 882196; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 883927; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 883952; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 883959; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 883968; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 884855; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 884891; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 886711; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 886741; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 891216; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 968660; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 973828; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1000476; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1002629; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1002638; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1009330; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1009349; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1012417; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1012429; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1056919; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1057071; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1057080; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1062395; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1062408; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1067673; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1067682; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1067852; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1071930; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1071939; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1214653; code bytes = 33c1 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 631996; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 734937; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1333379; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1413456; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1660740; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1660748; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1687834; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1692869; code bytes = 8030 Found XOR loop in file "is-NP4K53KHHN.tmp" at offset 1699460; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 372213; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 401155; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 900563; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1125997; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1135566; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1257981; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1258017; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1258085; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1259355; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1259421; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1259487; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1259543; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1260533; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1260599; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1260665; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1260731; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1260797; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1260863; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1260929; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1260995; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1261061; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1261127; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1261195; code bytes = 30d0 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 232011; code bytes = 33c1 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 330476; code bytes = 33c1 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 800087; code bytes = 33c1 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 900459; code bytes = 33c1 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 946993; code bytes = 33c1 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 947150; code bytes = 33c1 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1116541; code bytes = 33c1 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 336450; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 337154; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 624035; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 634143; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 687847; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 889271; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 919952; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 935794; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 954536; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 963264; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1057702; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1378388; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1378635; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1380292; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1388296; code bytes = 8030 Found XOR loop in file "is-TI0PC5YQ7W.tmp" at offset 1392476; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 183656; code bytes = 33c1 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 334240; code bytes = 33c1 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 140044; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 348080; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 394785; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 396147; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 396591; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 403176; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 540556; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 558737; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 560422; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 570235; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 578835; code bytes = 8030 Found XOR loop in file "is-UX3ZV8ZHNE.tmp" at offset 580520; code bytes = 8030 Found XOR loop in file "is-U2E6XUOJW4.tmp" at offset 17758; code bytes = 33c1 Found XOR loop in file "is-U2E6XUOJW4.tmp" at offset 47760; code bytes = 33c1 Found XOR loop in file "is-U2E6XUOJW4.tmp" at offset 99828; code bytes = 8030 Found XOR loop in file "is-19PT4BDO01.tmp" at offset 15179; code bytes = 33c1 Found XOR loop in file "is-19PT4BDO01.tmp" at offset 33432; code bytes = 8030 Found XOR loop in file "is-19PT4BDO01.tmp" at offset 35117; code bytes = 8030 Found XOR loop in file "is-19PT4BDO01.tmp" at offset 40497; code bytes = 8030 Found XOR loop in file "is-19PT4BDO01.tmp" at offset 45400; code bytes = 803030:Td4b,Found string "INDOWS\\system32\\drivers\\vmusbmouse.sys"" (Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.035E0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmstorfl.sys" (Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000001.189562.06977000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp 00000000-00000696.00000002.190024.06977000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmgencounter.sys" (Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.035E0000.00000004.mdmp 00000000-00000696.00000002.190024.035E0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmusbmouse.sys" (Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.067F0000.00000004.mdmp 00000000-00000696.00000002.190024.067F0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\DRIVERS\vm3dmp-debug.sys" (Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.067F0000.00000004.mdmp 00000000-00000696.00000002.190024.067F0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vms3cap.sys" (Source: "00000000-00000696.00000001.189562.067F0000.00000004.mdmp 00000000-00000696.00000002.190024.067F0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\DRIVERS\vm3dmp_loader.sys" (Source: "00000000-00000696.00000001.189562.067F0000.00000004.mdmp 00000000-00000696.00000002.190024.067F0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\DRIVERS\vm3dmp-stats.sys" (Source: "00000000-00000696.00000001.189562.067F0000.00000004.mdmp 00000000-00000696.00000002.190024.067F0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\DRIVERS\vm3dmp.sys" (Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000001.189562.06977000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp 00000000-00000696.00000002.190024.06977000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmbus.sys" (Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\VMBusHID.sys" (Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmci.sys" (Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000001.189562.06977000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmgid.sys" (Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\DRIVERS\vmmemctl.sys" (Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000001.189562.06977000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmmouse.sys" (Source: "00000000-00000696.00000001.189562.06906000.00000004.mdmp 00000000-00000696.00000002.190024.06906000.00000004.mdmp")31:T79e,Found string "INDOWS\\system32\\drivers\\vmusbmouse.sys"" (Indicator: "vmusb"; Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.035E0000.00000004.mdmp"), Found string "vmusbmouse" (Indicator: "vmusb"; Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.067F0000.00000004.mdmp 00000000-00000696.00000002.190024.067F0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmusbmouse.sys" (Indicator: "vmusb"; Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.067F0000.00000004.mdmp 00000000-00000696.00000002.190024.067F0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmci.sys" (Indicator: "\vmci"; Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000001.189562.06977000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp"), Found string "VMMemCtl" (Indicator: "vmmemctl"; Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000001.189562.06977000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp"), Found string "C:\WINDOWS\system32\DRIVERS\vmmemctl.sys" (Indicator: "vmmemctl"; Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp 00000000-00000696.00000001.189562.06977000.00000004.mdmp 00000000-00000696.00000002.190024.068A0000.00000004.mdmp"), Found string "vmmouse" (Indicator: "vmmouse"; Source: "00000000-00000696.00000001.189562.06906000.00000004.mdmp 00000000-00000696.00000002.190024.06906000.00000004.mdmp"), Found string "C:\WINDOWS\system32\drivers\vmmouse.sys" (Indicator: "vmmouse"; Source: "00000000-00000696.00000001.189562.06906000.00000004.mdmp 00000000-00000696.00000002.190024.06906000.00000004.mdmp")32:T4e0,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000696.00000001.189562.0053D000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000696.00000001.189562.0053D000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")33:T45c,Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")34:T4e7,Found system information discovery API: "GetSystemInfo" in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" Found system information discovery API: "WTSRegisterSessionNotification" in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" Found system information discovery API: "GetMonitorInfoW" in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" Found system information discovery API: "GetNativeSystemInfo" in file "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00000696.00000001.189562.0053A000.00000004.mdmp, 00000000-00000696.00000002.190024.0053A000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp"35:T767,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp, 00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")36:T101b,Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): LongInt;" (Indicator: "sendmessage"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): Boolean;" (Indicator: "postmessage"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp")37:T658,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetSystemInfo" with parameters (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "QueryPerformanceCounter" (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetSystemMetrics" with parameters (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "EnumDisplayMonitors" with parameters (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetSystemInfo" with parameters (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "QueryPerformanceCounter" (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetSystemInfo" with parameters (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "QueryPerformanceCounter" (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetSystemMetrics" with parameters (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "EnumDisplayMonitors" with parameters (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetSystemInfo" with parameters (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "QueryPerformanceCounter" (UID: 00000000-00004864)38:T2dae,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000002f011c00000000c02975000028758000000000600600001000002000000000000001e7aafb8b5402000090fb2f01e99cab77d0354574e8fa2f016fd7587450fb2f01506aad770babfb8bfeffffff60fb2f01e3e258740600000090fb2f01f0d7587472e624de00000000803651000000da740000000080365100000000000000000028fb2f01b0334574bcfb2f01f0fb5a74423068abfeffffff88fb2f0129a84074540200007cfb2f010c000000e99cab7700000000080000000d00000000000000c8fb2f018baafb8b00000000c8fb2f018ff74174000000009aeb56f0819e1700200d7905a999170001000000f86217000000000066981700e0fb2f01 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000790510f57905e05a760510f57900905b7605e05a760500f67905b0f82f01a854290018f57905b25429003c010000ed070a0cd4f82f0110f5790510f57905d4f82f0110f57905ccf82f012b5e290070f92f01405e29004a5e290000f6790500f67905dcfb2f01da602900ed070a0cf4ffffff00000000000001085365676f65205549000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f67905 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000f48679050800000000000000000000000000000094fb2f0156b75a740004000000010000f486790508000000f4867905080000003c010000c4fb2f010800000010000000c8fb2f0142781900f4867905080000005ef141ff7a6f1700b9ad1700ecfb2f019c071800f80f5200ecfb2f018b071800f80f5200e8fb2f0113ca24001dca2400f0ae2000a8507b05a028780501000000f0ae200000000000a0bd78053bd521000200000000000000584f7b058bde2100f0ae200011981700a0bd7805379b1700f0ae2000a0bd7805939b1700f0ae200006e4210010e421000100000048fc2f014cfc2f0126e42100b8415100ee000000d7415100388c4400 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000017a8fb8b0000000050fb2f013f8aaa770000000001000000b0fa2f01ffff00000c027a05fb8caa7700000000000000000c027a0580fb2f010000000000000000000000006feb417409000000d0375e03090000000c027a050000000070a25b7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000a3aafb8b84fb2f0111b958740000a37478fb2f010000000080fb2f01000000006feb41740000a37420b14f001c001d000c027a05fcfcac77844fb177b5000000c8fb2f0104000000a0fb2f010c000000ccfb2f01648607004c0102000000000000000000230000c06e4fb1773c01000070a25b74da4fb177c4010000000000000c00000027aafb8be8fb2f0183a25b74c4010000e7fb2f01000000004cfc2f01d6af4f00c401000000fc2f014c0164866c877905000000000000e9730000e973000000006c8779050000000040fc2f012030f6737a6f1700ddad17003cfc2f01 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000008fa8fb8bb0f92f0111b95874be18ab7733a8fb8b58335f030000000000fa2f016feb417400000000000000001800190088f92f01b055a47424fa2f01506aad771ba661fdfeffffffbe18ab77a245ab7758335f0358ea5e0318fa2f0158335f0358335f0008fa2f010000000008fa2f016060ab7705000000c00253009b6f170000fa2f014aea56f0acf52f010000000074fa2f01822644748a993c85feffffff40fa2f01a4d729757400060096040000112700000000000000000000b7020000e1d72975a50381cb5cfc2f010c474f00740006009604000011270000 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ab7708e22f0198e12f0134e0ab7704f32f010400000002000000842df100080015c01403000000b00b01c0e12f0100e00b01e4e12f0152614a75d0d96103488662750000000046e565229ce22f01c7964b7500000000d0d9610348866275011800009ce22f01d2964b75d82f4475501e4b75f9964b7500000000d82f4475d40761030ce32f01d0d96103000000004ce22f013f10a574080015c090cc497501000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006a5e5a7418e32f01dbcc49750100000000000000040000006eff24de (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b0d1f20638cfaa776c3b5e031cd2f20601000000203b5e036c3b5e03203b5e03040000000400000000e06474001000001cd2f20601000000203b5e03cd97aa779c97aa77cf85268cb50f5b74203b5e030000aa7700000000dc10726d0000000080ee617401000000e996a977f8e2647400000000040000000000000048406374f8e2647420d2f20680e8ec7650a65e0380e8ec761cd2f2060000000080e8ec767900730057004f005700360034000000c8187e740026827318000000f8d6f206b4d2f2060301000028e6f20651197e7400000000000000000000000000000000ffffffff000000000000000000000000d6e45f03ece45f03 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b0d1f20638cfaa776c3b5e031cd2f20601000000203b5e036c3b5e03203b5e03040000000400000000e06474001000001cd2f20601000000203b5e03cd97aa779c97aa77cf85268cb50f5b74203b5e030000aa7700000000dc10726d0000000080ee617401000000e996a977f8e2647400000000040000000000000048406374f8e2647420d2f20680e8ec7650a65e0380e8ec761cd2f2060000000080e8ec767900730057004f005700360034000000c8187e740026827318000000f8d6f206b4d2f2060301000028e6f20651197e7400000000000000000000000000000000ffffffff000000000000000000000000761167038e116703 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b0d1f20638cfaa776c3b5e031cd2f20601000000203b5e036c3b5e03203b5e03040000000400000000e06474001000001cd2f20601000000203b5e03cd97aa779c97aa77cf85268cb50f5b74203b5e030000aa7700000000dc10726d0000000080ee617401000000e996a977f8e2647400000000040000000000000048406374f8e2647420d2f20680e8ec7650a65e0380e8ec761cd2f2060000000080e8ec767900730057004f005700360034000000c8187e740026827318000000f8d6f206b4d2f2060301000028e6f20651197e7400000000000000000000000000000000ffffffff000000000000000000000000260b85063a0b8506 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b0d1f20638cfaa776c3b5e031cd2f20601000000203b5e036c3b5e03203b5e03040000000400000000e06474001000001cd2f20601000000203b5e03cd97aa779c97aa77cf85268cb50f5b74203b5e030000aa7700000000dc10726d0000000080ee617401000000e996a977f8e2647400000000040000000000000048406374f8e2647420d2f20680e8ec7650a65e0380e8ec761cd2f2060000000080e8ec767900730057004f005700360034000000c8187e740026827318000000f8d6f206b4d2f2060301000028e6f20651197e7400000000000000000000000000000000ffffffff000000000000000000000000eee75f0304e85f03 (UID: 00000000-00000696)39:T4dd,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000b0aaa57364925b0350925b03852fdecfb8d72f0188f6a673a4d82f01809da5739d2657bdfeffffff25a0a5733fa0a573b0aaa57320d82f011f62a573b0aaa573735f7c7401000000b8f5a673885f7c741062a5737c737ac250d82f01d899a573f432a5730833a573a8b65a7400000000b8b65a7452c524de50d82f01 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000005b038000000000000000a1140000e4d72f01ee13aa7780000000ee13aa770000000000000000800000009073a2730000000004d82f0150727a7400005b0300000000800000009073a273020000007033a27320d82f019b73a27301000000f045a373885f7c74000000007c737ac250d82f015875a2736433a273 (UID: 00000000-00000696) "FnHotkeyUtility.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000006600740000000000000000000000000072000000000065000000000000000100000034002000000034002e00404444219a01000000000000010000000100000072002e000000000000000000400000006c000000f01245219a01000000000000140000000a0000009a01000000000000 (UID: 00000000-00005816)3a:T7a3,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp")3b:T9fc,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "function GetVersionComponents(const Filename: String; var Major, Minor, Revision, Build: Word): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")3c:T9f3,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT * FROM Win32_SystemDriver" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT TotalPhysicalMemory FROM Win32_ComputerSystem" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Size FROM Win32_LogicalDisk WHERE DeviceID = 'C:'" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT DeviceID FROM Win32_PnPEntity WHERE DeviceID LIKE '%PNP0F13%' AND DeviceID LIKE '%22F5829E%'" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT DeviceID FROM Win32_PnPEntity WHERE DeviceID LIKE '%PNP0303%' AND DeviceID LIKE '%22F5829E%'" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT DeviceID FROM Win32_PnPEntity WHERE DeviceID LIKE '%RHT1234%' AND DeviceID LIKE '%22F5829E%'" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_Processor" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Caption FROM Win32_Process WHERE NOT Caption IS NULL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="ekrn.exe"" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="avastui.exe"" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="avp.exe"" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="bdservicehost.exe"" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="dwengine.exe"" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="egui.exe"" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="360Safe.exe"" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="wrsi.exe"" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" issued a query "SELECT Name FROM Win32_ProcessWHERE Name="endpointprotection.exe""3d:T10ee,Found string "SELECT Name FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1963225013") Found string "SELECT Caption FROM Win32_Process WHERE NOT Caption IS NULL" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1963462902") Found string "SELECT Name FROM Win32_ProcessWHERE Name="ekrn.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968348031") Found string "SELECT Name FROM Win32_ProcessWHERE Name="avastui.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968408739") Found string "SELECT Name FROM Win32_ProcessWHERE Name="avp.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968449036") Found string "SELECT Name FROM Win32_ProcessWHERE Name="bdservicehost.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968489615") Found string "SELECT Name FROM Win32_ProcessWHERE Name="dwengine.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968525508") Found string "SELECT Name FROM Win32_ProcessWHERE Name="egui.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968563439") Found string "SELECT Name FROM Win32_ProcessWHERE Name="360Safe.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968603573") Found string "SELECT Name FROM Win32_ProcessWHERE Name="wrsi.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968640205") Found string "SELECT Name FROM Win32_ProcessWHERE Name="endpointprotection.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696-00002714-1968678958") Found string "instance of Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp, 00000000-00000696.00000002.190024.06977000.00000004.mdmp") Found string "SELECT Name FROM Win32_ProcessWHERE Name="360Safe.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found string "SELECT Name FROM Win32_ProcessWHERE Name="egui.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp, 00000000-00000696.00000002.190024.066F0000.00000004.mdmp") Found string "SELECT Name FROM Win32_ProcessWHERE Name="dwengine.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found string "SELECT Name FROM Win32_ProcessWHERE Name="wrsi.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found string "SELECT Name FROM Win32_ProcessWHERE Name="avastui.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found string "SELECT Name FROM Win32_ProcessWHERE Name="avp.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found string "SELECT Name FROM Win32_ProcessWHERE Name="ekrn.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found string "SELECT Name FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found string "ECT Name FROM Win32_ProcessWHERE Name="endpointprotection.exe"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found string "SELECT Caption FROM Win32_Process WHERE NOT Caption IS NULL" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp, 00000000-00000696.00000002.190024.06906000.00000004.mdmp") Found string "aption = 'svchost.exe';Handle = '1188';};" "instance of Win32_Process{Caption = 'svchost.exe';Handle = '1256';};" "instance of Win32_Process{Caption = 'svchost.exe';Handle = '1264';};"" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp"), Found string "","instance of Win32_Process{Caption = 'csrss.exe';Handle = '396';};","instance of Win32_Process{Caption = 'wininit.exe';Handle = '512';};","instance of Win32_Proce" (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp"), file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp")3e:T487,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "CreateDirectoryW" with parameter %TEMP%\is-W3JVYFA2OF.tmp (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-NM3MSY6NHG.tmp (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-NM3MSY6NHG.tmp\_isetup (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "CreateDirectoryW" with parameter %TEMP%\is-5YM7DW5ZW9.tmp (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-HOJYZOFYNR.tmp (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-HOJYZOFYNR.tmp\_isetup (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\VioletPink (UID: 00000000-00004864)3f:T24ef,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %TEMP%\is-NM3MSY6NHG.tmp\_isetup\_isdecmp.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter SbieDll.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter avghookx.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter avghooka.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter snxhk.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter api_log.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter dir_watch.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter wpespy.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter cmdvrt32.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter cmdvrt64.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter SxIn.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter cuckoomon.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %TEMP%\is-HOJYZOFYNR.tmp\_isetup\_isdecmp.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00004864) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005816)40:T53d,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\VioletPink\is-TI0PC5YQ7W.tmp & %ALLUSERSPROFILE%\VioletPink\FnHotkeyUtility.exe (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\VioletPink\is-NP4K53KHHN.tmp & %ALLUSERSPROFILE%\VioletPink\ludp.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\VioletPink\is-UX3ZV8ZHNE.tmp & %ALLUSERSPROFILE%\VioletPink\msvcp140.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\VioletPink\is-2B1Z04HMIV.tmp & %ALLUSERSPROFILE%\VioletPink\spkvol.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\VioletPink\is-U2E6XUOJW4.tmp & %ALLUSERSPROFILE%\VioletPink\vcruntime140.dll (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\VioletPink\is-19PT4BDO01.tmp & %ALLUSERSPROFILE%\VioletPink\vcruntime140_1.dll (UID: 00000000-00004864)41:T1168c,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008152) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressInit (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompress (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressEnd (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RtlInitAnsiString (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter LdrGetProcedureAddress (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00000696) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003952) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressInit (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompress (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressEnd (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter RtlInitAnsiString (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter LdrGetProcedureAddress (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SHGetStockIconInfo (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SHGetImageList (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004864) "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00004864) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005816) "FnHotkeyUtility.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005816)42:T136b,"SELECT * FROM Win32_SystemDriver" (Source: 00000000-00000696-00002714-1929024358, Indicator: "select * from win32_systemdriver") "SELECT TotalPhysicalMemory FROM Win32_ComputerSystem" (Source: 00000000-00000696-00002714-1962995500, Indicator: "select totalphysicalmemory from win32_computersystem") "SELECT Size FROM Win32_LogicalDisk WHERE DeviceID = 'C:'" (Source: 00000000-00000696-00002714-1963030270, Indicator: "select size from win32_logicaldisk where deviceid = 'c:'") "SELECT DeviceID FROM Win32_PnPEntity WHERE DeviceID LIKE '%PNP0F13%' AND DeviceID LIKE '%22F5829E%'" (Source: 00000000-00000696-00002714-1963082785, Indicator: "select deviceid from win32_pnpentity where deviceid like '%pnp0f13%' and deviceid like '%22f5829e%'") "SELECT DeviceID FROM Win32_PnPEntity WHERE DeviceID LIKE '%PNP0303%' AND DeviceID LIKE '%22F5829E%'" (Source: 00000000-00000696-00002714-1963131043, Indicator: "select deviceid from win32_pnpentity where deviceid like '%pnp0303%' and deviceid like '%22f5829e%'") "SELECT DeviceID FROM Win32_PnPEntity WHERE DeviceID LIKE '%RHT1234%' AND DeviceID LIKE '%22F5829E%'" (Source: 00000000-00000696-00002714-1963177693, Indicator: "select deviceid from win32_pnpentity where deviceid like '%rht1234%' and deviceid like '%22f5829e%'") "SELECT Name FROM Win32_Processor" (Source: 00000000-00000696-00002714-1963225013, Indicator: "select name from win32_processor") "SELECT Caption FROM Win32_Process WHERE NOT Caption IS NULL" (Source: 00000000-00000696-00002714-1963462902, Indicator: "select caption from win32_process where not caption is null") "SELECT Name FROM Win32_ProcessWHERE Name="ekrn.exe"" (Source: 00000000-00000696-00002714-1968348031, Indicator: "select name from win32_processwhere name="ekrn.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="avastui.exe"" (Source: 00000000-00000696-00002714-1968408739, Indicator: "select name from win32_processwhere name="avastui.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="avp.exe"" (Source: 00000000-00000696-00002714-1968449036, Indicator: "select name from win32_processwhere name="avp.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="bdservicehost.exe"" (Source: 00000000-00000696-00002714-1968489615, Indicator: "select name from win32_processwhere name="bdservicehost.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="dwengine.exe"" (Source: 00000000-00000696-00002714-1968525508, Indicator: "select name from win32_processwhere name="dwengine.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="egui.exe"" (Source: 00000000-00000696-00002714-1968563439, Indicator: "select name from win32_processwhere name="egui.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="360Safe.exe"" (Source: 00000000-00000696-00002714-1968603573, Indicator: "select name from win32_processwhere name="360safe.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="wrsi.exe"" (Source: 00000000-00000696-00002714-1968640205, Indicator: "select name from win32_processwhere name="wrsi.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="endpointprotection.exe"" (Source: 00000000-00000696-00002714-1968678958, Indicator: "select name from win32_processwhere name="endpointprotection.exe"") "SELECT * FROM Win32_SystemDriver" (Source: 00000000-00000696.00000000.187640.035E0000.00000004.mdmp, 00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.035E0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp, 00000000-00000696.00000002.190024.035E0000.00000004.mdmp, Indicator: "select * from win32_systemdriver") "SELECT * FROM Win32_SystemDrive" (Source: 00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp, Indicator: "select * from win32_systemdrive") "SELECT Name FROM Win32_ProcessWHERE Name="360Safe.exe"" (Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp, Indicator: "select name from win32_processwhere name="360safe.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="egui.exe"" (Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp, 00000000-00000696.00000002.190024.066F0000.00000004.mdmp, Indicator: "select name from win32_processwhere name="egui.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="dwengine.exe"" (Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp, Indicator: "select name from win32_processwhere name="dwengine.exe"") "SELECT TotalPhysicalMemory FROM Win32_ComputerSystem" (Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp, Indicator: "select totalphysicalmemory from win32_computersystem") "SELECT Name FROM Win32_ProcessWHERE Name="wrsi.exe"" (Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp, Indicator: "select name from win32_processwhere name="wrsi.exe"") "SELECT Name FROM Win32_ProcessWHERE Name="avastui.exe"" (Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp, Indicator: "select name from win32_processwhere name="avastui.exe"")43:T407,Sleep@KERNEL32.DLL at 00000000-00003952-12491-112-012C3EB8 Sleep@KERNEL32.DLL at 00000000-00003952-12491-113-012C3C14 Sleep@KERNEL32.DLL at 00000000-00003952-12491-117-012C423C Sleep@KERNEL32.DLL at 00000000-00003952-12491-181-012C6CC4 Sleep@KERNEL32.DLL at 00000000-00003952-12491-186-012C677C Sleep@KERNEL32.DLL at 00000000-00003952-12491-211-012C4434 Sleep@KERNEL32.DLL at 00000000-00003952-12491-2627-012C4A64 WaitForSingleObject@KERNEL32.DLL at 00000000-00003952-12491-2954-012FB86C Sleep@KERNEL32.DLL at 00000000-00003952-12491-2966-013588F4 WaitForSingleObject@KERNEL32.DLL at 00000000-00003952-12491-3485-01357BCC Sleep@KERNEL32.DLL at 00000000-00003952-12491-3708-013694F8 MsgWaitForMultipleObjects at 00000000-00003952-12491-3725-01369F84 WaitForSingleObject@KERNEL32.DLL at 00000000-00003952-12491-3927-012E422A Sleep@KERNEL32.DLL at 00000000-00003952-12491-3933-012E4358 WaitForSingleObject@KERNEL32.DLL at 00000000-00003952-12491-3934-012E4220 Sleep@KERNEL32.DLL at 00000000-00003952-12491-5935-012E3DFD44:T675,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")45:T718,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")46:T89e,"Software\Embarcadero\Locales" in Source: cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe "Software\CodeGear\Locales" in Source: cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe "Software\Borland\Locales" in Source: cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe "Software\Borland\Delphi\Locales" in Source: cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.035E0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00000696.00000000.187640.035E0000.00000004.mdmp 00000000-00000696.00000001.189562.035E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" in Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00000696.00000002.190024.067F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00000696.00000002.190024.067F0000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00000696.00000002.190024.06977000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp47:Te88,Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:696:168:WilStaging_02" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:696:168:WilStaging_02" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:696:64:WilError_01" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "Local\SM0:696:64:WilError_01" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "Local\SM0:696:168:WilStaging_02" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "Local\ZonesCacheCounterMutex" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "SM0:696:168:WilStaging_02" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "Local\ZonesLockedCacheCounterMutex" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "SM0:696:64:WilError_01" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\BaseNamedObjects\SyncRootManager" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:696:64:WilError_01" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4864:168:WilStaging_02" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4864:168:WilStaging_02" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4864:64:WilError_01" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer"48:T85a,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "SbieDll.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "avghookx.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "avghooka.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "snxhk.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "api_log.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "dir_watch.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "wpespy.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "cmdvrt32.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "cmdvrt64.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "SxIn.dll" - [base:0; Status:c0000135] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" failed to load missing module "cuckoomon.dll" - [base:0; Status:c0000135] "FnHotkeyUtility.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "FnHotkeyUtility.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "FnHotkeyUtility.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "FnHotkeyUtility.exe" failed to load missing module "%WINDIR%\SYSTEM32\symsrv.dll" - [base:0; Status:c0000135]49:T46f,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-NP4K53KHHN.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-UX3ZV8ZHNE.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "is-U2E6XUOJW4.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "is-19PT4BDO01.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF4a:Ta11,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000696.00000000.187640.035E0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00000696.00000000.187640.035E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000696.00000001.189562.035E0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00000696.00000001.189562.035E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" in Source: 00000000-00000696.00000002.190024.035E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00000696.00000002.190024.067F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00000696.00000002.190024.067F0000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00000696.00000002.190024.06977000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003952.00000000.190332.012C1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00004864.00000000.190406.004EC000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00004864.00000000.190406.00752000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00004864.00000000.190406.00752000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00004864.00000000.190406.00752000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00004864.00000000.190406.00752000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004864.00000000.190406.00752000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004864.00000000.190406.00752000.00000004.mdmp4b:T2688,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 742e0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" loaded module "KERNEL32.DLL" at base 74a30000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 742c0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74e60000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" loaded module "RPCRT4.DLL" at base 74cc0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74240000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" loaded module "NTDLL.DLL" at base 77a60000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74170000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 742e0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "KERNEL32.DLL" at base 74a30000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "MSCTF.DLL" at base 75120000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "IMM32.DLL" at base 74da0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74240000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "NTDLL.DLL" at base 77a60000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "RPCRT4.DLL" at base 74cc0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "UXTHEME.DLL" at base 74240000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75a70000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 742c0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74e60000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73d60000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%TEMP%\IS-NM3MSY6NHG.TMP\_ISETUP\_ISDECMP.DLL" at base 5530000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 73d30000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 73cc0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "WINHTTP.DLL" at base 73dc0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73c10000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 744a0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 73bf0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 779e0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73b70000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73b50000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73b40000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73a80000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 744a0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 744a0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSWOW64\SCRRUN.DLL" at base 73a50000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSWOW64\WSHOM.OCX" at base 73a20000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "SHELL32.DLL" at base 75a70000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73810000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74a30000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "USER32.DLL" at base 75280000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73390000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75a70000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73640000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "MSISO.DLL" at base 73330000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "SSPICLI.DLL" at base 74480000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 744a0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76db0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%TEMP%\IS-HOJYZOFYNR.TMP\_ISETUP\_ISDECMP.DLL" at base 4a00000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "COMCTL32" at base 73ec0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "COMCTL32.DLL" at base 73ec0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 73b20000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 73b70000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "DWMAPI.DLL" at base 74210000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 57e0000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 73550000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74170000 "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 74210000 "FnHotkeyUtility.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffecaba0000 "FnHotkeyUtility.exe" loaded module "ADVAPI32.DLL" at base 7ffef0680000 "FnHotkeyUtility.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffeee4a0000 "FnHotkeyUtility.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffeee4a0000 "FnHotkeyUtility.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffeee4a0000 "FnHotkeyUtility.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffec1880000 "FnHotkeyUtility.exe" loaded module "SHLWAPI.DLL" at base 7ffef03a0000 "FnHotkeyUtility.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffeedae0000 "FnHotkeyUtility.exe" loaded module "VERSION.DLL" at base 7ffee5e20000 "FnHotkeyUtility.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffec0db0000 "FnHotkeyUtility.exe" loaded module "USER32.DLL" at base 7ffef10e0000 "FnHotkeyUtility.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffeee4a0000 "FnHotkeyUtility.exe" loaded module "MSCOREE.DLL" at base 7ffecae40000 "FnHotkeyUtility.exe" loaded module "NTDLL" at base 7ffef1770000 "FnHotkeyUtility.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffef0d10000 "FnHotkeyUtility.exe" loaded module "PSAPI.DLL" at base 7ffef0220000 "FnHotkeyUtility.exe" loaded module "RPCRT4.DLL" at base 7ffef1620000 "FnHotkeyUtility.exe" loaded module "KERNEL32.DLL" at base 7ffef1270000 "FnHotkeyUtility.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffebf6f0000 "FnHotkeyUtility.exe" loaded module "OLE32.DLL" at base 7ffef0bb0000 "FnHotkeyUtility.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffef0d10000 "FnHotkeyUtility.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffeee4a0000 "FnHotkeyUtility.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffebf5a0000 "FnHotkeyUtility.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffeec0f0000 "FnHotkeyUtility.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffecb6f00004c:T831,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WinHttp.WinHttpRequest.5.1.CreateObject" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WinHttp.WinHttpRequest.5.1.SetTimeouts" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WinHttp.WinHttpRequest.5.1.Open" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1.CreateObject" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1.ConnectServer" with result: "IDispatch" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1("ConnectServer").ExecQuery" with result: "IDispatch" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery").Count" with result: "346" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery").ItemIndex" with result: "IDispatch" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery")("ItemIndex").Unnamed" with result: "1394ohci" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery")("ItemIndex").Unnamed" with result: "3ware" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery")("ItemIndex").Unnamed" with result: "ACPI" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery")("ItemIndex").Unnamed" with result: "AcpiDev" ... "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery")("ItemIndex").Unnamed" with result: "acpiex" ...4d:Tb06,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" was detected as "Inno Setup Module" and name: "Installer" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" was detected as ".NET Reactor" and name: "Protector" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" was detected as "Turbo Linker" and name: "Linker" "_isdecmp.dll" was detected as "Inno Setup Module" and name: "Installer" "_isdecmp.dll" was detected as ".NET Reactor" and name: "Protector" "_isdecmp.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "_isdecmp.dll" was detected as "Turbo Linker" and name: "Linker" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" was detected as "Inno Setup Module" and name: "Installer" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" was detected as ".NET Reactor" and name: "Protector" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" was detected as "Turbo Linker" and name: "Linker" "is-NP4K53KHHN.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-NP4K53KHHN.tmp" was detected as ".NET Reactor" and name: "Protector" "is-NP4K53KHHN.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-NP4K53KHHN.tmp" was detected as "Turbo Linker" and name: "Linker" "is-UX3ZV8ZHNE.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-UX3ZV8ZHNE.tmp" was detected as ".NET Reactor" and name: "Protector" "is-UX3ZV8ZHNE.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-UX3ZV8ZHNE.tmp" was detected as "Turbo Linker" and name: "Linker" "is-U2E6XUOJW4.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-U2E6XUOJW4.tmp" was detected as ".NET Reactor" and name: "Protector" "is-U2E6XUOJW4.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-U2E6XUOJW4.tmp" was detected as "Turbo Linker" and name: "Linker" "is-19PT4BDO01.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-19PT4BDO01.tmp" was detected as ".NET Reactor" and name: "Protector" "is-19PT4BDO01.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-19PT4BDO01.tmp" was detected as "Turbo Linker" and name: "Linker" "_setup64.tmp" was detected as "Inno Setup Module" and name: "Installer" "_setup64.tmp" was detected as ".NET Reactor" and name: "Protector" "_setup64.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "_setup64.tmp" was detected as "Turbo Linker" and name: "Linker"4e:T1114,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\WOW6432NODE\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "FileSystem Object" (Path: "HKCU\WOW6432NODE\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Windows Script Host Shell Object" (Path: "HKCU\WOW6432NODE\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Shared Bitmap Object" (Path: "HKCU\WOW6432NODE\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\TREATAS") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS")4f:T67c,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "FnHotkeyUtility.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "FnHotkeyUtility.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")50:T744,Observed system executable string:"%WINDIR%\system32\bcrypt.dll" [Source: 00000000-00008152-00000C2B-1926773883] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00000696-00000C2B-1928203753] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00000696-00000C2B-1928222443] Observed system executable string:"%WINDIR%\system32\shfolder.dll" [Source: 00000000-00000696-00000C2B-1928341239] Observed system executable string:"%WINDIR%\system32\Rstrtmgr.dll" [Source: 00000000-00000696-00000C2B-1928401652] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00004864-00000C2B-1973114527] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005816-00000C2E-130552858] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005816-00000C2B-1974905671] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005816-00000C2B-1974956246] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005816-00000C2B-1974997338] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00005816-00000C2B-1975110422] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005816-00000C2B-1975149529] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005816-00000C2B-1975176035] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00005816-00000C2B-1975235866]51:T713,Spawned process "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" with commandline "/SL5="$60074 5049803 1208320 C:\\cdc58e74d07a3bfef2e479c2c0f99b4 ..." (UID: 00000000-00000696), Spawned process "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" with commandline "/VERYSILENT /PASSWORD=81954cee-247e-431c-9283-858ca0af8623" (UID: 00000000-00003952), Spawned process "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" with commandline "/SL5="$70074,5049803,1208320,C:\\cdc58e74d07a3bfef2e479c2c0f99b4 ..." (UID: 00000000-00004864) Spawned process "FnHotkeyUtility.exe" with commandline "--webview-exe-name=SearchHost.exe" (UID: 00000000-00005816) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00006392) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006884), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00006128), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004968), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002824), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004116), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00006648), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00001912)52:T713,Spawned process "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" with commandline "/SL5="$60074 5049803 1208320 C:\\cdc58e74d07a3bfef2e479c2c0f99b4 ..." (UID: 00000000-00000696), Spawned process "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" with commandline "/VERYSILENT /PASSWORD=81954cee-247e-431c-9283-858ca0af8623" (UID: 00000000-00003952), Spawned process "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" with commandline "/SL5="$70074,5049803,1208320,C:\\cdc58e74d07a3bfef2e479c2c0f99b4 ..." (UID: 00000000-00004864) Spawned process "FnHotkeyUtility.exe" with commandline "--webview-exe-name=SearchHost.exe" (UID: 00000000-00005816) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00006392) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006884), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00006128), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004968), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002824), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004116), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00006648), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00001912)53:Te66,The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: 2B:56:9D:5A:30:51:78:CD:39:CD:44:E3:B0:28:BA:2E:14:DF:82:41; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS ECC CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C6:A7:9F:4F:A3:32:C1:3F:51:DB:C6:1F:5D:2B:37:2F:71:ED:6B:69; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: BF:E7:BA:21:A2:FA:56:71:9B:61:F6:4E:E1:B2:69:D0:B8:0B:44:E5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: F0:7C:BA:F5:80:4B:9C:1D:DA:1B:51:AD:28:80:50:58:3E:04:60:DE; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 04, O=Microsoft Corporation, C=US" (SHA1: F7:F8:05:29:62:E6:A7:1C:EE:D5:B8:5A:74:7B:EE:37:D1:59:C0:E0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: DA:6D:04:00:64:1B:45:AE:CC:59:5D:24:E5:03:7A:A6:BC:09:C3:58; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 7B:40:95:9C:A6:F3:08:E5:89:4E:40:4C:00:30:B1:DF:B8:63:30:45; see report for more information)54:T448,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NM3MSY6NHG.tmp\_isetup\_setup64.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NM3MSY6NHG.tmp\_isetup\_isdecmp.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-5YM7DW5ZW9.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HOJYZOFYNR.tmp\_isetup\_setup64.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HOJYZOFYNR.tmp\_isetup\_isdecmp.dll"55:T612,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000696.00000000.187640.056A0000.00000004.mdmp, 00000000-00000696.00000001.189562.056A0000.00000004.mdmp") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003952.00000000.190332.01373000.00000004.mdmp, 00000000-00003952.00000000.190332.04810000.00000004.mdmp, 00000000-00003952.00000001.190409.01373000.00000004.mdmp")56:T9e1,"_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-NM3MSY6NHG.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00000696] "FnHotkeyUtility.exe.log" has type "CSV ASCII text"- [targetUID: N/A] "is-2B1Z04HMIV.tmp" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%ALLUSERSPROFILE%\VioletPink\is-2B1Z04HMIV.tmp]- [targetUID: 00000000-00004864] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-W3JVYFA2OF.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp]- [targetUID: 00000000-00000696] "is-NP4K53KHHN.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\VioletPink\is-NP4K53KHHN.tmp]- [targetUID: 00000000-00004864] "is-TI0PC5YQ7W.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 Mono/.Net assembly 7 sections"- Location: [%ALLUSERSPROFILE%\VioletPink\is-TI0PC5YQ7W.tmp]- [targetUID: 00000000-00004864] "is-UX3ZV8ZHNE.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\VioletPink\is-UX3ZV8ZHNE.tmp]- [targetUID: 00000000-00004864] "is-U2E6XUOJW4.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\VioletPink\is-U2E6XUOJW4.tmp]- [targetUID: 00000000-00004864] "is-19PT4BDO01.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\VioletPink\is-19PT4BDO01.tmp]- [targetUID: 00000000-00004864] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-HOJYZOFYNR.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00000696] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-HOJYZOFYNR.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00000696] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-5YM7DW5ZW9.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp]- [targetUID: 00000000-00000696] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-NM3MSY6NHG.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00000696]57:T6f8,"is-2B1Z04HMIV.tmp" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections" - Location: [%ALLUSERSPROFILE%\VioletPink\is-2B1Z04HMIV.tmp] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\is-W3JVYFA2OF.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp] "is-NP4K53KHHN.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections" - Location: [%ALLUSERSPROFILE%\VioletPink\is-NP4K53KHHN.tmp] "is-TI0PC5YQ7W.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 Mono/.Net assembly 7 sections" - Location: [%ALLUSERSPROFILE%\VioletPink\is-TI0PC5YQ7W.tmp] "is-UX3ZV8ZHNE.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%ALLUSERSPROFILE%\VioletPink\is-UX3ZV8ZHNE.tmp] "is-U2E6XUOJW4.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%ALLUSERSPROFILE%\VioletPink\is-U2E6XUOJW4.tmp] "is-19PT4BDO01.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%ALLUSERSPROFILE%\VioletPink\is-19PT4BDO01.tmp] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections" - Location: [%TEMP%\is-HOJYZOFYNR.tmp\_isetup\_setup64.tmp] "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\is-5YM7DW5ZW9.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections" - Location: [%TEMP%\is-NM3MSY6NHG.tmp\_isetup\_setup64.tmp]58:T77b,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")59:T109f,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "CDC58E74D07A3BFEF2E479C2C0F99B442CE77657B3DC6A57592D32D7824D2616.EXE"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CDC58E74D07A3BFEF2E479C2C0F99B442CE77657B3DC6A57592D32D7824D2616"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")5a:T54c,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size5b:T4dc,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "\Device\CNG" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\WINDOWS\SysWOW64\kernelbase.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\Windows\SysWOW64\ole32.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\WINDOWS\SysWOW64\ole32.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"5c:Tc14,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\FLTLIB.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\MSVCP140.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\MSVCP140.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\IPHLPAPI.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\BCRYPT.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\bcrypt.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\WTSAPI32.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\FLTLIB.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\MSVCP140.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\MSVCP140.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\VCRUNTIME140.DLL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\VCRUNTIME140.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\CRYPTSP.DLL"5d:Te3a,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-W3JVYFA2OF.TMP" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\WINSPOOL.DRV" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\winspool.drv" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\CDC58E74D07A3BFEF2E479C2C0F99B442CE77657B3DC6A57592D32D7824D2616.TMP.LOCAL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-W3JVYFA2OF.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp.Local\" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-NM3MSY6NHG.TMP" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NM3MSY6NHG.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\ADMIN" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\admin" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\ProgramData\VIOLETPINK" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\ProgramData\VioletPink" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-5YM7DW5ZW9.TMP" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-5YM7DW5ZW9.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-5YM7DW5ZW9.tmp\CDC58E74D07A3BFEF2E479C2C0F99B442CE77657B3DC6A57592D32D7824D2616.TMP.LOCAL" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-5YM7DW5ZW9.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp.Local\" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-5YM7DW5ZW9.tmp\WINSPOOL.DRV" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-5YM7DW5ZW9.tmp\winspool.drv" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-HOJYZOFYNR.TMP" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HOJYZOFYNR.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG"5e:T71c,"cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" writes file "c:\users\%osuser%\appdata\local\temp\is-w3jvyfa2of.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" writes file "%temp%\is-w3jvyfa2of.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes file "c:\users\%osuser%\appdata\local\temp\is-nm3msy6nhg.tmp\_isetup\_setup64.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes file "c:\users\%osuser%\appdata\local\temp\is-nm3msy6nhg.tmp\_isetup\_isdecmp.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes file "%temp%\is-nm3msy6nhg.tmp\_isetup\_setup64.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes file "%temp%\is-nm3msy6nhg.tmp\_isetup\_isdecmp.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" writes file "c:\users\%osuser%\appdata\local\temp\is-5ym7dw5zw9.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe" writes file "%temp%\is-5ym7dw5zw9.tmp\cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes file "c:\users\%osuser%\appdata\local\temp\is-hojyzofynr.tmp\_isetup\_setup64.tmp" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes file "c:\users\%osuser%\appdata\local\temp\is-hojyzofynr.tmp\_isetup\_isdecmp.dll" "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.tmp" writes file "c:\programdata\violetpink\is-ti0pc5yq7w.tmp"5f:T6e8,Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp")60:T55c,Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe")61:T41a,Found reference to API "WNetGetConnectionW" (Indicator: "NetGetConnection"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "NetGetConnection"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; Source: "00000000-00000696.00000001.189562.00533000.00000004.mdmp, 00000000-00000696.00000002.190024.00533000.00000004.mdmp")62:Td1a,Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "cdc58e74d07a3bfef2e479c2c0f99b442ce77657b3dc6a57592d32d7824d2616.exe")63:T552,Found reference to API "Caption = "Windows Socket 2.0 Non-IFS Service Provider Support Environment";" (Indicator: " socket "; Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp, 00000000-00000696.00000001.189562.035E0000.00000004.mdmp, 00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found reference to API "Description = "Windows Socket 2.0 Non-IFS Service Provider Support Environment";" (Indicator: " socket "; Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp, 00000000-00000696.00000001.189562.035E0000.00000004.mdmp, 00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found reference to API "DisplayName = "Windows Socket 2.0 Non-IFS Service Provider Support Environment";" (Indicator: " socket "; Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp, 00000000-00000696.00000001.189562.035E0000.00000004.mdmp, 00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found reference to API "stemDriver';Description = 'Windows Socket 2.0 Non-IFS Service Pr" (Indicator: " socket "; Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp") Found reference to API "Windows Socket 2.0 Non-IFS Service Provider Support Environment" (Indicator: " socket "; Source: "00000000-00000696.00000001.189562.068A0000.00000004.mdmp, 00000000-00000696.00000002.190024.068A0000.00000004.mdmp")64:T7a8,Pattern match: "msn.com/en-us/entertainment/celebrities/" Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://crl.certum.pl/ctnca.crl0k_0]0" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0y4$" Heuristic match: "trc.taboola.com" Heuristic match: "px.ads.linkedin.com" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "foykqvoveop26b5n74swkarkif8l4itbx2pgzra5gtbk9atkcvnxua5h3tr.com" Heuristic match: "m.adnxs.com" Heuristic match: "r.msftstatic.com" Heuristic match: "sb.scorecardresearch.com" Pattern match: "http://schemas.microsoft.com/smi/2005/windowsse" Pattern match: "http://[3e3d:4c4d:3e3d:4d3e]/" Heuristic match: "cim_system.name" Heuristic match: "font.name" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "cim_system.na" Heuristic match: "m.name" Heuristic match: "im_system.name" Heuristic match: "der.sy" Heuristic match: "xe;.bat;.cm" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"65:T1991,Found URL "http://[3e3d:4c4d:3e3d:4d3e]/lmemstanlmem[t" - Source: "00000000-00000696.00000000.187640.035E0000.00000004.mdmp") Found URL "http://[3e3d:4c4d:3e3d:4d3e]/lmemstanlmem[t" - Source: "00000000-00000696.00000001.189562.035E0000.00000004.mdmp") Found URL "http://[3e3d:4c4d:3e3d:4d3e]/lmemstanlmem[t" - Source: "00000000-00000696.00000002.190024.035E0000.00000004.mdmp") Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00003952.00000000.190332.012C1000.00000020.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0y4$)kr" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\^" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://pki.eset.com/crt/csca2020.crt05.0,0*$http://pki.eset.com/crl/csca2020.crl0ib0@00%0" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://pki.eset.com/csp0jte;u" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://pki.eset.com/crt/rootca2020.crt0700.0,&http://pki.eset.com/crl/rootca2020.crl0?806040%0" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://pki.eset.com/csp0elxqj^x8;,*+-*" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://pki.eset.com/crt/tsca2020.crt05.0,0*$http://pki.eset.com/crl/tsca2020.crl0?806040%0" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://pki.eset.com/csp0rleog9[jrg" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://pki.eset.com/csp0'dbgc" - Source: "00000000-00004864.00000000.190406.004EC000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00004864.00000000.190406.00752000.00000004.mdmp") Found URL "https://npcap.com/