26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample f2a18b8cbd48… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f2a18b8cbd48…. Malware family: Zusy.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T48c,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp")28:T51f,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp")29:Tbca,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005144.00000002.140362.EF339000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp")2a:T857,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007916.00000000.136822.EF101000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007916.00000000.136822.EF101000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007916.00000000.136822.EF101000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007916.00000000.136822.EF101000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007916.00000000.136822.EF101000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007916.00000000.136822.EF101000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007916.00000000.136822.EF101000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007916.00000000.136822.EF101000.00000002.mdmp")2b:T826,"'sqlite_sequence' AND coalesce(rootpage,1)>0" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select sql from "%w".sqlite_schema where type='table'and name<>'sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT sql FROM "%w".sqlite_schema WHERE type='index'" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select sql from "%w".sqlite_schema where type='index'"), "SELECT'INSERT INTO %s.'||quote(name)||' SELECT*FROM"%w".'||quote(name)FROM %s.sqlite_schema WHERE type='table'AND coalesce(rootpage,1)>0" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select'insert into %s.'||quote(name)||' select*from"%w".'||quote(name)from %s.sqlite_schema where type='table'and coalesce(rootpage,1)>0"), "INSERT INTO %s.sqlite_schema SELECT*FROM "%w".sqlite_schema WHERE type IN('view','trigger') OR(type='table'AND rootpage=0)" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "insert into %s.sqlite_schema select*from "%w".sqlite_schema where type in('view','trigger') or(type='table'and rootpage=0)"), "CREATE TABLE x" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "create table x"), "DELETE FROM %Q.sqlite_master WHERE name=%Q AND type='index'" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "delete from %q.sqlite_master where name=%q and type='index'"), "SELECT*FROM"%w"" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select*from"%w""), "INSERT INTO %Q.sqlite_master VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "insert into %q.sqlite_master values('trigger',%q,%q,0,'create trigger %q')"), "CREATE TABLE %Q.%s(%s)" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "create table %q.%s(%s)"), "CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "create table x(key,value,type,atom,id,parent,fullkey,path,json hidden,root hidden)"), "SELECT name_on_card expiration_month expiration_year card_number_encrypted nickname date_modified FROM credit_cards;" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select name_on_card expiration_month expiration_year card_number_encrypted nickname date_modified from credit_cards;"), "SELECT origin_url action_url username_value password_value date_created date_last_used FROM logins;" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select origin_url action_url username_value password_value date_created date_last_used from logins;"), "SELECT host_key path name expires_utc encrypted_value is_secure FROM cookies;" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select host_key path name expires_utc encrypted_value is_secure from cookies;"), "SELECT service encrypted_token binding_key FROM token_service;" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select service encrypted_token binding_key from token_service;"), "SELECT client_name encoded_scopes token expiration_date FROM access_tokens;" (Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin, Indicator: "select client_name encoded_scopes token expiration_date from access_tokens;")40:Te6af,Found reference to API (Indicator: "CryptAcquireContextA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegQueryValueExA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptReleaseContext"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptDestroyKey"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptGetHashParam"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptDestroyHash"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptSetKeyParam"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptDecrypt"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptHashData"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetCurrentHwProfileA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegOpenKeyExA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegEnumValueA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptCreateHash"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegCloseKey"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetUserNameA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegSetValueExW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptImportKey"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegGetValueW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RegEnumKeyExA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptUnprotectData"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CryptStringToBinaryA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateCompatibleDC"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DeleteObject"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DeleteDC"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetStretchBltMode"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "StretchBlt"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "BitBlt"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SelectObject"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FindNextFileW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "HeapSize"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CancelIo"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateTimerQueueTimer"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "UnlockFileEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FreeLibrary"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateEventA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LoadLibraryExA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ReadProcessMemory"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualAllocEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetGeoInfoW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateProcessW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DeleteTimerQueueTimer"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "lstrlenW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "Process32Next"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateDirectoryA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateMutexW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FindNextFileA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DeleteFileW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetOverlappedResult"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FindFirstFileA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ResetEvent"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateNamedPipeW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RemoveDirectoryA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "AreFileApisANSI"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GlobalLock"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "Sleep"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "TerminateProcess"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualLock"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CopyFileW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SizeofResource"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateFileMappingW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WriteProcessMemory"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "HeapCompact"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "lstrcmpiA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualUnlock"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFileAttributesExA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ExitThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "HeapFree"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "HeapValidate"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFileSize"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateFileA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetTempPathW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "Process32First"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CloseHandle"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetVersionExW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FindClose"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateFileMappingA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DeleteTimerQueue"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LockFileEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WriteFile"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetTempPathA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualFreeEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFileAttributesA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetProcAddress"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetSystemTimes"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetUserGeoID"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LoadResource"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FormatMessageA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DeleteFileA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualFree"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetComputerNameA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LocalFree"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualQuery"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateTimerQueue"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetTempFileNameA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "lstrlenA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GlobalUnlock"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "HeapCreate"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "HeapDestroy"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CopyFileA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetLastError"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFileType"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "UnlockFile"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CancelIoEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateProcessA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualProtect"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetFilePointer"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FlushViewOfFile"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ReadFile"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LocalAlloc"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetVersionExA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "VirtualProtectEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LockFile"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetUserPreferredUILanguages"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateRemoteThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetSystemTime"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateMutexA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "QueryFullProcessImageNameA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "LockResource"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateFileW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FormatMessageW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "HeapAlloc"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateEventW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetTickCount"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "TlsGetValue"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetVolumeInformationA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetFullPathNameA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ConnectNamedPipe"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "QueryDosDeviceW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FindFirstFileW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "FindResourceW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "OpenProcess"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "TerminateThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "IsWow64Process"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SHCreateDirectoryExW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SHGetFolderPathA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SHGetFolderPathW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "PathRemoveFileSpecW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "OpenClipboard"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "MessageBoxA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SystemParametersInfoA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetClipboardData"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetWindowTextA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetDC"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "MessageBoxW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CloseClipboard"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ReleaseDC"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpWriteData"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpReadData"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpSendRequest"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpConnect"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpOpen"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "WinHttpSetOption"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "BCryptSetProperty"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "BCryptDestroyKey"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "BCryptDecrypt"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DisplayVersion"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CharLowerW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CharUpperW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateEventExW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateFile2"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetTickCount64"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "UuidCreate"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "UuidCreateSequential"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetThreadDescription"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateSemaphoreA"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetCurrentThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetHandleInformation"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetThreadContext"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GetThreadPriority"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GlobalAlloc"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GlobalFree"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "GlobalSize"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "InitializeSRWLock"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RaiseException"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ReleaseSemaphore"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "ResumeThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetEvent"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetLastError"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetThreadContext"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetThreadPriority"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SuspendThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "TlsAlloc"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "TlsSetValue"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "CreateWindowExW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DefWindowProcW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DestroyWindow"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "DispatchMessageW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "EmptyClipboard"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "SetClipboardData"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "TranslateMessage"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "UnregisterClassW"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SetProcessAffinityMask"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp, 00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005144.00000002.140362.EF339000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005144.00000002.140362.EF339000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00005144.00000002.140362.EF339000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00005144.00000002.140362.EF339000.00000002.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00005144.00000002.140362.EF339000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00005144.00000003.145824.73C48000.00000002.mdmp")41:T59a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005144.00000001.138442.EF375000.00000002.mdmp")42:T71d,"Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00008084.00000000.136469.51F30000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008084.00000000.136469.51F30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008084.00000000.136469.51F30000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00008084.00000000.136469.54510000.00000004.mdmp "??\c:\users\hapubws\appdata\roaming\opera software\opera gx stable\local state" in Source: 00000000-00008084.00000001.137410.51F76000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008084.00000001.137410.53C00000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00008084.00000001.137410.53C00000.00000004.mdmp "SOFTWARE\Valve\Steam" in Source: 00000000-00008084.00000001.137410.53C00000.00000004.mdmp "Software\Google\Chrome\BLBeacon" in Source: 00000000-00008084.00000001.137410.54141000.00000004.mdmp "Software\Microsoft\Edge\BLBeacon" in Source: 00000000-00008084.00000001.137410.54141000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00008084.00000001.137410.5450D000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00008084.00000001.137410.54646000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00008084.00000001.137410.54646000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00008084.00000001.137410.54646000.00000002.mdmp43:T7b9,"GET /api/v1/accounts/116089313715962613 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: ioc.exchange" Response ==> HTTP/1.1 200 OK Date: Wed 15 Apr 2026 11:16:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 891 Connection: keep-alive Vary: Accept-Encoding server: Mastodon x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 0 x-clacks-overhead: GNU Natalie Nguyen referrer-policy: same-origin x-ratelimit-limit: 300 x-ratelimit-remaining: 297 x-ratelimit-reset: 2026-04-15T11:20:00.342264Z vary: Authorization Origin cache-control: max-age=15 public stale-while-revalidate=30 stale-if-error=86400 etag: W/"6b5227bc7f76bf5aedde60a3b88faf85" content-security-policy: default-src 'none'; frame-ancestors 'none'; form-action 'none' x-request-id: 98c5ea1e-bec9-428a-84f6-97789819831b x-runtime: 0.006827 strict-transport-security: max-age=63072000; includeSubDomains X-Cached: HIT with response body ==>7B226964223A22313136303839333133373135393632363133222C22757365726E616D65223A2277656C6F7665696F63646F7465786368616E6765222C226163....... "GET /api/v1/accounts/ HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: ioc.exchange" Response ==> HTTP/1.1 200 OK Date: Wed 15 Apr 2026 11:16:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 2 Connection: keep-alive server: Mastodon x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 0 x-clacks-overhead: GNU Natalie Nguyen referrer-policy: same-origin x-ratelimit-limit: 300 x-ratelimit-remaining: 299 x-ratelimit-reset: 2026-04-15T11:20:00.956968Z vary: Authorization Origin cache-control: private no-store etag: W/"4f53cda18c2baa0c0354bb5f9a3ecbe5" content-security-policy: default-src 'none'; frame-ancestors 'none'; form-action 'none' x-request-id: 752ba382-9c12-474f-9c98-1432f44d9120 x-runtime: 0.003884 strict-transport-security: max-age=63072000; includeSubDomains X-Cached: MISS with response body ==>5B5D.......44:Tad8,"?'^Yh^PKW_%YZ\DNUH^"i3F_PJFtPRCJl{]X\^W#U??s\XcX_PZnPzofE]%]\RK9'_TYB%VF::{}xadms7-x,&qu`~0+1%an x;8 _[jGVU [?6y{'{gddF\P?WRH]??rdkz: x>!g{tpY'[o6D]Bkqwb6rajk[^_Mh]^L]AOVGC[WG<;qy(&}3*dppin)|.rh'ejgUDJk{wg6#42=?/{svt$46vx1v_ X=fFRBKn}palt20e BqQGT8(P[5l}x~y|0udorak?%&2{a,dqn3"^xh=,6/#vgh~mec~zs60v30=9{2)>{ z}[recABEerfb!60=qEpQCY96STY?^8=~njbhtz -r\ i`AZ^CqQTDeX]U\J:9yY%FP^wkmAe-v26 6`ix^]vGXG\;o j\4[[T\B;/gn=hE_u?`DVPAWZ'lzUS[]9.DX9]RA_{ifxwr*4j=KFDVXWVZpYko/svaaXse`zxs,60=cL@UZW81P\!Y>6z{soaibHJBS?e\^WZ1\RJ5YRUZnky5,<)x&v3)9a`({+-)DvlmAPCBe~$3l#4aiqCE R?{WP[ef@WDXZ@jg^i3MD_WWWe6T@isn`BTKE9+x16pbcot%RVd*^TXZn3BY^ER[D?1XZh`NLTkY X=fFRBKn}palt20e BqQGT8(P[d+XTKYAVBe`ZXS @Esd5UKZB%VFk]QFXACVN?[vo`@?y6dunen"@F}VGWk1Y[h^AU^'\niXs^\]Ai_^]S4k3saxvm0YOp zHto|!qbp{sXO5#cMbrrK.5/d'XL6`soa}te&n311}vu`f+6>r1tp/erzbg1uxzwnk33v&gcxj:-"ww1~$*'3|YD]^WUC}\QAZkTGI_\tSYy[Q\:256)q|6d-1=-vcr|8;aky&&j2 `jbvc-7(|-4GPZnbX_]YiWGc[P=ER:|X]C^CjtjgQXCrY[]DNJS>"\|Cds@E^pB=n316pyyp'^=fRJmgLT^S;3dved*.-/qx&sXVW4od1/)$jyxw~{ytz96JAixre1&6`?vHuVMWn/_UX[obR?CYQILk8jD%A\AUq<;jO\1]ZDv^86z-sw1b:3bw.`zocD=xt3ar`k9%B}C?.PT[llWXA<3b(3"Yn`CVG8)r3bz1bkxFB'QBXkYT?5UX9:bk 6"|j!x/"+/qrcsfza`3%S"??e`p6 .~"~v[urj}f,`aepQ nkef&ftxu$-(mk*v/*,&cgxvq~pu|e.7v1NtcfuV%l96d}4vts+qflude:i40$be1{v~t Y%e0D={tgezef<;N_P^qld|* .d0:26z4="2c0697367ÃUnö5c478eof29)^VCHLbG^ULUCr{jr#IW4uU|ob+are~u+k3*31w4078edf29¶È¯Ûh35982?119eMAHGÚßÛ¥ëÕ®îÓ¡±Ô¤ëÒ ±Õ¥¾Õõéô§¢¸Õ®íðºÛó¿õê¦¢Ò®º×§¹Û í¬öCÒ¥½òéÑö Úð¹Õ¯¾Ðõ¸Ô¯¿Ñ ¿÷ë¦½¢¸ÕòD¤±¡êôéÑ£¿Ò®º×¤¦ECA¤½Ò¥½òéÑõ¿Úð¹Õ¯¾Ðõ¸Ô¬ Ñ ¿÷ë¦½¢¸Õ®íðºÛó¿õê¦¢Õ¦°Ð£¹Ó¯¾õ±õº×¦»×òì¦ôÚð¹Õ¯¾Ðõ¸Ô¯¿Ñ ¿ôôAÒ£ëÖ¦¿ÚðóFEõê¥½Õ¦°Ð£¹Ó¯¾õ±õº×¥¤×òì¥ëÕ®îÓ¡±Ô¤ëÒ ±Õ¦¡CACkÒ£ëÖ¦¿Úðð§©¢ò÷ñÑ §Ò¯×§¹Û í¬õ§¥Ò¦¥òéÑõ¿Úó¦Õ¯¾Ðõ¸Ô¯¿Ñ ¿ôôA×õ¼Ò¡°ñ÷Ð¬ÿÕ÷óô£×¡¸Ú¤½Ó¤ÔðóÛôóÐ Ñ£ì÷»¢¬¤§Û£¢¦¾Û¡»Ô¢ôACA¢¸Õ®íó¦Ûð§öò¦¥Õ¥¨Ð ¬Ó¬¬ö©ö¢×¦»×òì¦÷ÕöÓ¢©Ô§þÒ ±Õ¥¾Õöõô ×ö¤Ò¢¨ñöÐ¬øÕôë÷»×¢¤Ú§¥Ó¤©ÔóëÛ÷ëÐ §Ñ£ì÷»¢©FÐõ¸Ô¯¿Ñ££ôó¥¥¡ Õõó¯Ûó¿õê¦¡Õ¥¨Ð ¡Ó¯¾õ±ö¥?òéÑõ¿Úð¹Õ¯¾Ðõ¸Ô¯¿Ñ ¿ôô¦½¢¸Õ®íðºÛó¿õê¥½Õ¥©Ð£¹Ó¯¾öõº×¦»×ñóAÑõ¿Úð¹Õ¬§CÔ¯¿Ñ ¿ôòA¢¸Õ®íðºÛó¿õê¥½Õ¦°Ð ECÛ÷ëÐ£¸Ñ£ì÷»¡°§¿Û º¥¡Ô¡ëõéÒ òÚóì¤±¡êôéÑ£¿Ò¥Ó¯¾õ±õº×¦»×òì¥ëÕ®îÓ¢¨Ô¤ëÒ ±Õ¦§CACAÒ£ëÖ¦¿Úóì¤±¡ê÷öÕ¦°Ð£¹Ó¯¾õ±õº×¦»×ñð¦þF;Õ¬¬Ðö Ô¬§Ñ£§ôó¦½¢¸ÕôðºÛó¿öö¦¥Õ¥¨Ð£¹Ó¯¾ö¨õº×¦»×ñõ¦ùÕ®îÓ¡±Ô§ôÒ ±Õ¥¾ÕöðCA×õ¼Ò¡°ñ÷EÕôë÷»×¢¤Ú§¥Ó¤©ÔóëÛ÷ëÐ ¡DDAÑöÚó¡Õ¬¦Ðö Ô¬§Ñ ¿÷ë¥¤CÕ®íðºÛð¦BCB¥½Õ¦°Ð ¥Ó¬¦ö©ö¯Ñ£ì÷»¢¬¤§Û£¢¦¾Û¡»Ô¢òõéÒ£ëÖ¥¦EDFÛó¿õê¦¡Õ¥¨Ð ¡Ó¬«ECÛ÷ëÐ£¸Ñ ðô£¢¨§¿Û º¥¡<Õõé÷¸×õ¼Ò¡°òîÐ¯íÕôëô¢×¡¸Ú¤½Ó¤¨E¯é¤½Ò¦¤òéÑõ¿Úó Û£¨¦¾Û¡»Ô¡ëõéÒ òÚóì¤±¢óCBAÑ£¿Ò®º×¤ õ±õº×¥¢DDA¡°§¿Û º¦¾Û¡»Ô¡ëõéÒ òÚóì¤±¢óCBAÑ£¿Ò®º×§¹Û í¯é¤½Ò¥½ñöÑõ¿Úð¹Õ¬§CÒ ±Õ¥¾Õöð÷¸×õ¼Ò¡°òîÐ¯íÕôë÷»×¢§Ú¤½Ó§±ÔóëÛ÷ëÐ£¸Ñ£ì÷»¢¯§¿Û º¥§Ñ ¿÷ë¥¤C=Úðþ§©¢ò÷ñÑ §Ò¢×¤¡Û£ø¬û§¥Ò¦¨DD¦ùÕöÓ¢¤Ô§ùÒ£©Õ¦«CöûÒ óÖ¥§Úðô§¤EB÷ûÑ §Ò¯Û£ÿ¬ñ§¨×ñþ¦óÕû¥¬Û¢£Ô¢óöñÒ óÖ¥§Úðô§¤EB÷ûÑ §Ò¯Û£ÿ¬ñ§¥Ò¦¥ññÑö§Úó¡Õ¬«ÐöªÔ¬§Ñ£ªCAôª×ö¤Ò¢¥ñüÐ¬õÕ÷óô£×¢ Ú§¥Ó¤©ÔðþÛôùÐ Ñ ôô£¢¨¤§Û£¢¥«Û¢©Ô¢óöü¡ªÕõó¯EhRYRBA@e\ZKGN`YLndMSSUDBL2Q[UodLWKEBLVdQVFTnbMS\CCGPAMDMIeRUSUQ[9lcYYB1RV^VQQbEXXKCf\]V?ID$_AYTSFES3~X]PYtrk.0)b#a4%ZSr?mAPC~$3l#4a?yFP]\RWg0:dsYA'STqWTST'[O#qt UWP8at)D2ZRF!:tcc5_GYwRVWpChLvge|T\T,Mgv1!^[]QkpfbC!CSSsxM2HD%blEcWF8ricE VA?ID&c62oo{EBSdeqvCR'k']CGTF@\X\[IWW3LCpfczq^D/"=FrXLXFIb`|tj252q96gk1cc25øN,Äd`ù]~|'eOgU\R¹6upqCr!S4E2 +=ògßZô]ÛE ùÊÚ;.Tg`:B{n1aÃK%·r1èsÆ{²ZÖõ%5RúP¡=rÈ·Î±tÏ;ú%BãJºàµê^=!2¶D¦\îÜ¿o{4nV&4Àyt<%³qyAñJ7¶p¨9æîk±nèúRÓ?Ð<}UÈì]±¤I¦)p4u(.ág¼°Zg·Æc} 'á³ßÍÄt±¬P¶ñ 7ó3Õs!.«·Á!¼j/üÊ¢4ùxCG:?íþí¥ñìV3Q÷h"_Au'xmnFj½&09´xþc·ÎB^nj£iþ÷°UxÈ7!k/c}´få·0³Ì6 Ä´pÓ(ÒÙ#Lt°!8ü3p/PÁIÒqµ0hYSÒdcEõ5iÌøðTWdéL]ÂÊc÷Ç"sx3õGy+ù¤q¹%6$9a½º+§õþm¶¤¦ð_dÍ©´¼>;ñ=¡ÒÉ7RÀb±I(+c3¦6bO¼s?@]#rùÊÆÉ`¹¶Ó6»RÈ\Ù ²ÕO¶ªx°jU*](E*ûÂÈ÷á¿Ê´GP{ö*³/÷¹-¡ÀFpeý9°qwOÛM=íæö!ùò¤±}èô·Áwø++ ¥bs@«tôJ>&sø"ÔY?@EB±ºuXÍ×°sp|+÷ó'êtð$8/§Ùj§#ænÌm²$@rË÷ÐâGóV¶Ññ=0¸úcÈY9õ³±°²å£û+Cþãò3aõ!ïÈ¼!'·©x-ùç»¨vôþÍ¯64Ãg1m&]v_Ð0G>¼ttÑPw*g%pu?t.d Å*j=p{õ2M×O]Ñ#@Ôàë{ðWÐ×gvÆ÷} {~ÅUóE&á³a#ì±Ì bdKf[/©aöroåZ¯ü>8=åÁH4ZåòBºg-²Pp5¦¥ÇÀ:¨ª)ÎÚ^.³¥½-¿Æ9±E¿YUÛ´8ý°2÷r¶2ÀÌ={S &÷¯p¸HY¤Ð6§£âSû´±ù¥»ñ#1.D7Sð¢°¥*¤®Sçºnß.]¡zÆefö¾g1h(C?/ù_5ó/u¤2BôÃvãOÇ¶*|Yz¸Jt³»Q±²d®_!u7õwQb ÄPsèÒáÚ=×@´Ð mr±djB+²"¶Ê0 fmZaTú¥c$q[¤p²w+n½÷øôërÿnì'dÁj«ù¤uÞ&à÷{Ý3>p(,ð}auz® OZßö97-bËDhÓ*Íás;rQôØ;±÷µÏuì""°¿í od7?ti¤!u3û#ZÅÛëô¸b õðd+Á®B)¯¡{k.PáU/uáòp¿!Ç&EáèQä²@(ÔÃâåÏJ»®ãMw2Ý:'lÌÎåZÉ8B}°,@izÀ@¼øÂ5i¤Qè6Û1¢ÙÛ"¶|G¦rS°²ê~¼àèÝùÜn*z¹Eú$@¼¦ðåâ¦©³>o)ñkT!ïìîù~ÉU,ê3Ù¦ÈÀsà÷Ç=ã Cÿfk¿Gg÷EÕó<ÿ©mÅßvÌO'ñ>r{ÒÍ9æ4@åVI?Å±9·ÆF|{Ê'8?NÏ·çÇP0Fl´7ûcW=cnÔ±ÝU;£%öf6¾Ëãúz]_¢³ØT/a[Éðùyaò¢P!|y9^ÅâôÌÖ\ÉxD4Òc:Ø¢dÌoV3þ£÷¸WÅïdPÜÐ¹lÂ%qVe2$«s>¼µ[z>[ãýAë?dôíßxWÇ½CfyB223I²'V¡TÍej4MÚvüM¬ÐºwP[¿/h¯ `(þ´ìS`±ÌÒpÈþ2qP`ì¡ "Eú¾¼©Þ¥vñcÍ:c:êuÌqóøÙ¡e5ÙZnä±£oã5ÀÊÒxvÚda@p|!aîÚt º"mh¹ÕÝÈ"|XEtqT dÅ4N`7rS¾ËÓWñ°'ñåP,W·°S-%b¨|aÒ'l^¡×UXrz/×Îê]¨£²5¯Ep}ëæu}{æap}Úgõ[/òbp]':íÐ¼Åðoîõíùçsµ¾TÍ¿¤Än}1²UægÇÂÈyç¯;3ã§5ÙÉH+>ùp¢óCÅ·ÉåX(Yx®køUµc÷Øä$nx¢kö©¢oÆzò÷©èÉ§¿ªÎ®&¬®ïL§t·d¬uÊÂÉ¾¾~ÛîÅÇÌ?J=S/·cpIÙ0»íÛf(¤Ë"¹ÎY]På¾/Âí5ld_?ÝÓ X!Wtã÷´Bäæ&oGªàðÞÚ Wsã©ÈÌªRfÞ»ìï*z¸ù;g1³FV±ø»µ *èV®¾%¶WEjÏiém!@þÙ'%n4Ê£¢Òél~ 3¬¦AK±8åI6pRBÛõ=xzITtµÃ%´Cày±©à¬s2ý¡tk ê2í9¬Åf<}êåo®°$ã¨§»+Ö!gÕù!40ªRóå ÊF!L\cºº{u<ì4¹2Äüãjê®Ñ¸_õÅcUP4ö%´@ò·&^j¡ÜÄÈw:ukð&6[è»ù°6¥/(f©´0Ã-4.ñöì!¹xÆ)¨çí#:{Ë×)?ð´J4¥ÒU÷çÁáê «YÍv(Ä'¬^ tºÇBd»xÕqÔýò¨xZò$\'V|Ä§µ¿÷ &v¢rkÍ"HP·£rõÅö<.¼÷÷¦ßk:h¿6*â©Þ,@!v¨ªJõONÍÎ>OØV9Å$?²7q×3z(¡ù/«Hýè5{¥]GH2Å¿JI;Æd2[hêúìl¥í¿V Õv«gö<¶t¿VrÊTAµær÷äD8y(3$OÁ:mÇcQqPwYû#Ç@nfSvF(ñ|¢wr[7Ã@dºh+¹r#lh{ã¾ñyÏ¼Ç`ëxïÉE6QAÖíå+¶qÂ.*/í¾%!/UT/ÅSìY^Ê"bo½ð1'áÔÊCà¦¹tnhzÀ_6úÁïN¾y}ªz+Ä]Æ°Ýn.¯¿âVsüNò}[ñ6\ÿÔù5_Só¬°µ¤ÇôÎé£¬¤ëVwÝ16È2§o«¸(/Èj/Á3Æ\4%g:?jEWu@kÜ¿Ê¡m¡Íô9Ïl¢pzt?WáA4mÁêuä¸1Q8~/Þçõòã·Ë:î1Lf±Péõ#!ØkøðzOB¼AÍI(8º#d§Ä·X[¿4(bþ·ÚÛ·T=Â%|¸á?Q!×náaíe¥HÊ¾[zóÀyQ¹&¹bãöòw[3Jæ[Ú?Rýçò¿[º":¿Ïáò|üµ ¶d¥ì·¦=¾²¼i&35_·?üÁ¡ó|rh@ýóx6ÈhéÊ«Ù¼°;5^¼$F#½:b6xµùi¾rB>åSû¨S¦«5©Ù$[à`g?bzb4¡äÓv]+ä©à|ý ¤/ê_+îW]÷kú0a@çíEX(/öê>éï¹c¹RdÆFÉÎ·@%DýPû¦àRøò½ðz!BnF ÿZ×¹¿Ò|Ü»Ð.ö6JË§5ºÊ!¥ÇýÒÉÔæd¯>ÄËá8Æáß]6ª@.I:.áZX_th2íå#µj]5b¸¡dRó;dv=g"z?7F:³¢ìvÞÐÑ+¢9 ¨h³2r/|AGbÏ0wúW04O]¡Ö-K§¥f(÷vV¼OÃh~«´ôgÑ{)QqW$Ò+=2U¿¦ã=ã UQÀÁ.4 6z ] ûIµ5]qu1`ìðÐwþ©ª)ýA%ªÍÊvÕDcñ]jmWÝM8æ5pö'O{à"¹"'ëJ1AÊ¤åBà%h$Åý"ByýÑr;»5]::5# ´àâÓâ·ÅÀ¯»w¥^òZxÏZ0züIJe>0;äÙ2&×¡-÷/5ò6îÆ6êÉÍEêJh¯OÓÆÅB@wrzº¥N×¶4´yzx)ü¾6ø§éTpFBíRåZ¶³#··`¶9>ð#r½ªìÌW¬õ;8:#÷½¸¶²¾wàvéÊ'éÌP°k"!cW×þsT2v´'!~ùÙÇ^·Oam80@%bVâ/qkN¶»ßÿOu^ølÓb3Ó]<ü9µ{¦eôe8í"Ñc¤ÛUe#`%':k¤þµâx´ÑN`¢-ykçÅ\¿aÏJ}÷kÂ#ãV*.4¹×mpÆðBÒåÀÈ0kT^ñ©waàðæåMYr(ã´±!©Ý9¹o"}xBL&Ì|ý>lH¢v%ù5Í¤¼sÎ÷üèÕ?8FÊ+zÞd= þ¼'¾[Õ¤§&¬éJ´z$°?vß¦vXPFÚ5hÃ=e½ë{½anÝ¼LÌÊ2^d`'{=¯/<<@£kí´öù~«(óÅ\°9"B§!uR4nûZtªÕÊ¦Xt´f'X¡péÄÌgÌR,Ïêu-§fqéM8òþOw6BÆ8Eñ´ÇæiØ»=ÝéºÅCâ¹2ìð8ÕUDå[iï©\úäÓ°£,zØlqË°&`v*4¢×>k`b3ûµ/®Ãñåø¢Ô¡©eÒÉ!~¤³¸:a»OBã 1;Áz¤"rÿñý 6D>ÇÙ]u7¡³¥zx`rãÇ¨º5¯¿ÏbCÖ1ËÝÅ;»ô9´gçEÊs®À{õ*+~¸`ÈuëI?_?Ø{FÕw"÷tx4áÔ-2°ÂVU0-1`M´Àp5Ë0EsxûTZ³:æRìt°8Á9MÉ²¡müzõQ³u5V~JM\[0wlv>o¸®#[Aº`½ø|lÓB)»PSS@jó9@?"©È¡Ç3À=»,4P¸v¥ÁÖiHâpXMÂ8`2-6·åº¹éÐD¸xå¹§á+1if\4¤#³ÅíH50Vq105=Æòþø?å#©L'K;A#~ðº7G¤½wzÄ5¯eïR/§º¾#äE&Ôö?åu#ÈÀ!xp<.aówÔ{q0"Au}RpqæS;KëR#%ÓíÞÔ±|¤@/Ø ë»!w¸+¿1xI)Âªø½/4KT}_¥}`q&M×1ºFky8jFJ¯¶ò0¸-àoxzO~I~»b!ÿÞ<²9äó<µR >+!+Âa§Wänèøã$&õQ!ýE*û½D[ 4[RWf8ÙÏÈ¶{d¾6;0(,Kj¢-?³ç[ÛoEª@"37îÖQ.ºëSzu£©´Ï°¤[g¯ð >F"BiÒaý}òUïA>ã9|Éÿ¨dyí?C@*bt&ü*UbOIÕG+Ë³qºkKðk¾gÕ¶F:ÄU/ æ>IxXÊ:'x`Ã©$O,9/P"|&cME1Î>£¾0k^`0Op,ã{K´Ùdêa$ÃÍE)[¶Mú%l{ód_¸JåæG½9ÿÒñt@ÌCÚÏÌdoíbxØ('§ ZÆô ëMñ«ôäÎä@t^$g:ïlxñóP,M<ì_U&±,ÅìùPæJ¼ë_áåq.Ç4(¡ÉÁLóñfñ Ã2n¢öpR8(¶({ôsbÒïðÇrÚV)û±{X@!2^Å¿át /ÿ°G=5Ç¾0ö&äP£L$qäTæú1èÉP²Qµ®ù¸Tx0±;{ë24w0xÜ«ä¹üKTÕ6dð#Ë;ð0'üQ:ª[äe(¯®zßWibu9ãÍ¤U°qý<@gÑ PÊ0±&E³§§"¼ôuñ¿¹£Àúh]XyÀ_ùçOj»ð¯Ce|0ù½W&`/LèÛ(1y ®=%ï¯ÍÙU³mÃàµ².éßF³¯_½Ù q¿f3®w%q,*3ÑMu0ö[vªSüñöPóR+rÙq G"Ô¨taâXéRQãA*l-èqâ}äsÓí=%lð»]1.Sj8¿¸¢è¦=]ãÛ@ÍPøÜÔê3òëqKxÓ=i6t§ý£¦mÅS u@¨ÑE'4´w²K.#q(;u·¤bí¥8sOq#P¸z -&K|À(tàö5Ê% Ìú¡ãd;9|[LøüIu(ä´Îoô¦Ô+ò¸]ï6½7êjGq±:%¯|×õºlæY+hïMw0SxU!Þ3B£À/Ò&°;|ß¨»aZMÒ.(O>ÖÁjQ![D´{µQö½L#F3à¸&U|®$:ëâ¸`D]çúd,s%a:å·]ò))4b5T_U½5ÙI'ç%;e2¡õ4½ád;yØ¬|íßôËP·Ô>´|.³0XÓÞ9;E5âÏ.PNpP·ñà<*õ©HçÌRö?9qAqBò1þwûï¡÷uý?çZøIªò ïp4>ñÐ½Î±Y¾ô/Va±Ï%ò±þ8oËS×Aâá¹o.Ý#yBo`®øþd{_¹6saÝ»¾@û¥$í|8-¦«5Pð-@bg3@eÓë=l!÷2Üvpíí§'lp·]2P,ñPòbâ³tTö^/Öcs»À¼=*øómKuîó#YT øSÔºw^¿'£!Zµð%Joåwò'f÷Fq,eÈ^±dO¯Cv ¨\Oò«*R1")*T¡Üï¦ÐSE²}¸H±q(Z¼GPs¸>Rá»¹õåéqðú²Â?Q§®mKX(]¾:µ´ïû-?@×SC@*2Ôj[l$!9³m[¡&ªïÙh46}Ä*ï±iw tOWÓØ$¢¾b!5»xá t»õzl%Éh Õê=4?þ%ÔéÎ@láã÷Â|x´«½³--¢©G´¤ó&up¥6isTWìWA&|» »9g>ZyÔ²Qö5:[¦tzÇcL¾r[K9x&ÛHmB3*M#Ìö_·Yv~'ÅîLå$BÉ|h3G-Ç½>V¿kÌ¢WUÆå-®$,ùujf5/á¼©6ªúMçlûØ½)Zio½vÇ£ÑWZ»Á³ÿ§ø[I³b¦_'¦iuÎyÃiR¯t>ÿËhQ$þ¶öÆÆ9Â{ª»¾¶®4Ë¾¶¢¥ /$)6¹è7+-)¡92ñ¹¦yPö" PX4TZ>?aÔeéºm_«Hd.ùu³5ø¸Ì|)Vi+B¹U&aÃÞ®FXDG±= FRgÅ7ç:äZ?0j<¦N/:ã²G[^ëõZag®ù¥w¶[BS$3R5><Ø%µ'vÛµ6]¥t1;Jò."¼2¹hñßWu/¡t¼1þ³Ün~#K_)Ç{a$½º8@è&&Ø#¡©ðò¨(Ïä®d¬§¾:Êº&vÜWC>VÎ<=)ÕYb4øËúT4aû8Éý3yj!$Èa£uÜië5ô.Å*Þ°I}ã÷(cª¢ó¾èðc¬QÃUÆ¡¼âZåÏ!dðíí¤Az<¿¹»¾êJågÎs¤4«~éOï(F±¬ðxPódÐÑ,_ÎâPãj¸Â9ú2Û!¨»B^ÖH*(®#êÌ²ýÀ.i?¡:}2ÂÛn~ZAWÄF¡bF>¹fBÅ>e°¿Pgµ*#þ´i¨ºÎ¹Ë^C§^ÍYÏÁÔüÆ^æ®±a<Ñ+eçóôfþxóã,RsíQÍ{àíz6º{ó¤E×á53»5Óox$«óp÷8oß:µ¯1gø¾´u¸wë¢£¨3bQyKó4ûKÈú¡öÁÌ]ônÖ7ÑhP¦d3ïÒsª$X£=²%"§F9ûÑ»W"¸på©g=§ü3rÅ)lõZ"ªC-x-eDÒªqen9ýÒ1³´./ú?UÏ\]Q^8)]«¡¿M¬vS½iä¬b!É%qUtaÓÌLÞYbm& ÆÈç¼m±¢åõ+ÎÚZQy4kl0=Wcn¡j6§ðö`çKï§ðv¡m»H9õtÖ¡cdg|b &nmËò+¹Õ¾ÔÍPÍ?2ðzñ¾3Ý+¹MYX(:Cð %é&Má4B&£¬Å®xñâYWø©:Ç)5)üØ*Z¡µp2Aè"Q¦¦#WÍr¶v#m?ÖÞ2'x¸ÇÌfsç&xm2#n²¦19Ô~8u"¢»d.ô¹ì$ã5Z\¸6âôb3üÈ:h}? ï5¦ãOÃúÍQl%ü£&u1ë5ÑAmF%°¹dtväOFE½z¡É#'KE.f`qÇ£¼sÓRô§Ùy)ékUu füvø;êå%ó9yDëc,¶];Ôjâæ>iÞ7áqKÇQ¶ëPgÃ¶{z¨K*I ´ÑÃ¿bG°»e¾ËA¼0×ÆRQq$³t=t-ñXoó^´Gã(q%cð>4øÄ]ÇKT9ÐBJg`<6ñ¬°¸·}ìzÝå§!H«ì?oDòýyRÒ.JuqíBà¨X³F(FzU×-¬=ý}Ã@Áq_W_j¶iò[«P-}FÀð®yÅP¾ïèÑF£¦býzÃñ!.ÄPòß½&·zÊ·ca8ÑËPÌÀ¾Ùbò»¾=Içâ`±Ìùðð(àûAÏ!Iòë=ð°´¨0ÓyÉ+»yR#æò-ÔÀK4[õ'æð§$8±#"¢á±>EÔùpo6[x,0bäQÑÌ2*ÒãÇT¯µ·ÿ¼ó²6K4õeã{TõÝÎ5îkûxÂQµe#ñq§¦íU1 N´Pfåét-½úÑgt37é1A#!=n!~J.ÐBí{QqO¥«q5¸¥4+s>rT7ãÁöNáS3'9¨/îRÁ¶:Í$¥Ýh*%e`éä?¢5¸PÀ~=iü¹§ã¹Æ O»=#Ó¦äñFZçPèýÝ"y!£päÀ|à°ôðm±Ê&owDÑôÃ2;t/è)Òmöé1¹Öd5-3RÃ=P¦¤aBN®5ZÆóâu)Âxku¾lÐ´äüxñóùÆ©µÛFßî×3µ¡þYCÃµuTVÎHGFe»ÈÝãEõÇ-IBHªàÉÂNË¸ÿr6(P*ßÚþsìÝOÉBü¢ÞßÓ&Ô£ öC¸Ç¡ôýê~ê"½)bùa%öeJgyz+Ú|ER×òØ*b~ß2zÖÔ"÷ÃJB¦¬Ñ;Ñ[ìtKÎ×Aýæß!47ÊÀJÉ£×-PÒôýø{¹"(Â»/%´>Ê!íînõVÍ{µçPÔkâü¨&öI)¹¡¦¹-È=÷ºùâ·ÔUzhyÛDd)~jxc¼ï¡ùÃ¬ÑàaZ(îÆcLÊÏRPXêK6ZÎ³âÏPóã'jÃY.å`Úk5¿cSõ 3%³:@µãrÖ/+Üç4*e û®'ýWi7:¡4ýyÃná=·à=3,á- È[»pí.6$Ì¦\~:M4$£Üº [å1á¿Ô¯¢$W¸)ÌCíüx6Å¾Sù¾cTûâ&`ú6+bÚA¨u Þzl7÷J#áöòCkÍ«f1»±º$£n4¶ èv=ô@Ð6Ò)Ä¨yBÅ*wÇNcxÔth>V5AHò<ÆN½@{Ç¦R¶£äèæ´vPÊ)QÝÐ¶Nnr¸õ°î°Ø±#ºXC]oXóÛHÃÚ-'ñú&ÔæËM¬¶gÝpWüpôýõÊßýjQFÏæ¨èú¹¾½ª¬¾ì)t'%¥l&ÙÜL}èù:C`2ü¸èíHéÜ=5i;Yv]?C®3ëq*ðÇµ"ûúúÀ|¥á2ª3HéÓ#ÐzQ¿(Ó+q%µÂp"&½&Ol2íúÿgîV©»@ë¸¹3¾ò)Ù6ï*óNRv°6µF¼Ô¾sóWB9uG,CîÁdÁsõ·,;Óâm×>é{Ì4ªl¸°ûYXg62@|R764 h¯ö¡)¾Üµ,Ï[#X+g¤ä¥Î7%ÿ"fXï¾6e²£4m]¢.g·fñ°?¥ÎO'ïc>2ñ¿#S¢Æ(nû"z>äç¬°.Á 4&âÅ ¸e÷x0ÍÊð§ÊÃwàÁ)Àl°±¦ºáò³2KJz*Ós-eº»bù J"ptF#?®1.¿ 7Ö?!"øà$vÅ0h3Ì:LA§ù/ãtVöìUr¹/ÂÃ-3?@¬¼ð6d:á2QTÏÿå1_éôè)ïµx6Hò72-CÆ{_) otÙ;Håªã"Wq^ ½&k`>ûÍõRúqê`j"¹5pÌ:ÔRW#Sxwt«ó3¡³}ØüHs vcÞdÀá"¶o~ ÉÖ¼þSñ*È(?.÷.éQ\mØ·3¦9h'XeZLàÊüµ«J3;(Ñ=\¶U³94õ§ Ýk@ñº½v*¡4w;P¥{úá8¹N½4WYÌ¨Y3kð?ìÀÜçQ>ÒuCÉ¿Cx>37}Õ½b,ñ$ªµN-V+_î,9QÕ¤Ôõ}çN¤8]vÆ#UÎÏR£M0¤RÙKêªví·Óe)Xw k:¿7³«ÁîR¢¼Ü{áÐ¥áj/æc.V-ø¿ªtúfÅö¥ã°Ì·Ù {i"rØèÒí¥=Þ8GïÑK>Àå§ÅhkªÆó®±¬Â>îM¥w"±lÛ9'j=xR4z'A÷Or²ø ÓÃ±·²ðaÚ!åf£ÉO5µ!¯ñIÐ@»'58Gv}À =ðf¯zI!')SCD*Õô¯yp&4ä`ÌUQ÷h¥ÄX?®ÌüqÓC{X6±~N-HùM£qjÊÈG·Käãÿ=ï¯!¦ºy¡vRj%p8>uwi²[º7VC4_n³wSkJ3-Õòg\E¦¯Cî¼=$*±$&lüjÍ.ÀÇz5à.Ë:§~@¦LïcÕóÐE85û¥9°~?ÃQ6=íE!"%f;EN6Ð)ÂÂ§rÌ´ct¶VFå±p#¢é Î0{é8°él=[:Ô`;y·£Üc4+4ëÉÇZgM]uÉî³½:¦RôåÄpxÆÉVlèVÔå;âíåôã?å0M-¸D¼L#$sm9®²¯FÍPü¸åI>¨<½¥èFw½+T ¿Éi4GFò{OD#0S·uGå+-6_rè(}!<+Ç(qqIÎþw÷n;tÐÇÑO¿ã¢B_Ê£7#4v¥$¢/qpþå55ëoôSÙTuýìòõRT¢2Uú£@àý`Ë½F~¦zÑõC°q48RPSu½õ,J+¨'¯G7VÞ¬&Xõ® ¨!b«t-¸©^*j\ã¼Òµð,á5N2?©n%Ég²£vDRâ£uþ#ÖWR»S¶.õ©Åñ¶1Nù^ò'h#RÃLò4bj`¿6.t®ÉZ;VSõ:À¶cÖQóqòF1Æ_$05fÝ!vòÐo8DwÕq¾á?¡:ÿeSÇë1PÜñût2I»0WW4sã8uG fÆµY]c8cÝïrÀ Õ1&y»ÛË¸|¸¦Q?ì6ó·.m¹½io~"ÏG¸«záuMy«<4(6ÿÌj?¯±â-'è#¢#~c¶fK´="?àdjÿ½¯Æ5iYGAåIøÒÊ{¡bþ½¶ñw¹Ñøß¥¶2ËÃéëz3ð8üäödÉ%'Âj´Qn1¤l¿þ:nKvÍpåG)kCzÍ:G(ÿ¨·6¸1ÈAÆqY+íôwi´½ùôîþ¹éïèC>2ÒÌt1¨7ÀÂ¿¸MPq}æ*fø0'Ð÷¹lCÊm!þÞgìnÐ1_ËÏ§Ý¤«8ØtìÞÝì_ÙHô¤½FxÇ~$m·!FîÅ¦[k¥(;,_ó¢Qexà£Q!T¤3µ]gë!Á*Íï·þ}¡*3VýYea8Yè~C´)Cø¦Óì×0.dö_IP8°¹íÔªpå¦é}ÞLdúÉ÷²ãÀ¦1*¸èñÞ}P¹>¿B 0h¾¾5 Sx¦Ô¾~gïs©¿xZ\AOEÑë »¶Qxi½!.ÇF¡/+äÌd³Bd¯^ôk¦¯²W¿Kb35~cL®RÒøa¤@÷Ôð Ë÷ã}Ìjùÿ8'¤Ë¾üú¥ãk"c³!\¼|s Yq*!uy(è?½@{3ãñª¨¯E-¨hÚ¡tCÍ*Süzq÷±MÛÿvye¥lô×tãíÒÞc|À¶ñ-oP@nÝÍp*=wAÖçêSg{32¦bïêFsk8vO´ la®gQôÂg%àt3ë±«cå[¾x~\"A ·Í9nâUè¶âh¸Ú}Dñ)BÇQ!i&K¼·n?rÆ12\ïâ(ÔÄ:¼ÌMóP¡±y½èP=àxç÷åwæàr0àÊäÐT»Dï¾¢:dVNñx#B½9)ïXò¾K8ÒrÑ4¦fQr4ª(çV÷|êVÈóÍ"tØ|òd½,FÓRÑFý×%yÿÓ\§-ÌV7¡çæU#â±²Ît}KÈ-¼ñèê|ö&Rk°Ïb£g±#¾BBLÅM¸9¶¸ìÉ|ÓCrÙ¨(Zôl{¾ê¼q,J7 ½ò1¦â¡¾KD1}½·¾sdñbû~-SñsÊ)©øYn±8×v¹·2ùó0m)ÿ½ êðµ wÕ8=çhúk[_úÍL÷jµë_e0 ¨9I8®JÕ·+¿ì;2BqÚE3ß¾»Ëa?+?"ÒÏep=ÊRGÐulB¦0»à¸Ý82'zò/'àyP*v'5÷"=Ás«5Jû0}¶ódlLè¬$¹nÒj:hàÁmV<ö)e×ôFc¥U&±%u tÅÐ÷¹FÉÆ}:Ñ$%"; File: "PCAP"), Found string "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary362648A1w: PZPLZcomplete: true"; Source: "00000000-00008084-00000CCC-1110134050"), Found string "--%s%sContent-Disposition: form-data; name="%s""; Source: "00000000-00002312.00000000.136542.84617000.00000002.mdmp")4e:T739,Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin")4f:T4918,Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00002312.00000000.136542.84617000.00000002.mdmp") Found URL "https://clients2.google.com/cr/report%08x%x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899getsystemtimepreciseasfiletime__next_prime" - Source: "00000000-00002312.00000000.136542.EF1BD000.00000002.mdmp") Found URL "https://gcc.gnu.org/bugs/):" - Source: "00000000-00005144.00000002.140362.EF339000.00000002.mdmp") Found URL "https://watson.telemetry.microsoft.comoftware\microsoft\sqmclient\windows\commondatapoints807310433457345724575929012728system\currentcontrolset\control\systeminformationsystemmanufacturerbiosversionsystemproductnamecomputerhardwareidhardware\description\system\centralprocessor\0" - Source: "00000000-00007916.00000000.136822.2847F000.00000002.mdmp") Found URL "https://nw-umwatson.events.data.microsoft.com/telemetry.requestapplication/xmlcontent-typecontent-lengthmsa_deviceticketapplication/x-binarywerreportmetadataprocess_idprocessinformationimagenamecmdlinesignatureuptimewow64iptenabledprocessmetadataproblemsignatureseventtypeparameter%04d-%02d-%02dt%02d:%02d:%02dzreportinformationguidsourcecreationtimememorymini..\..\third_party\crashpad\crashpad\edge_watson_uploader\secondary_data_collectors\file_collector_win.ccgetfileattributes" - Source: "00000000-00007916.00000000.136822.2847F000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00007916.00000000.136822.2847F000.00000002.mdmp") Found URL "http://www.w3.org/2000/xmlns/" - Source: "00000000-00007916.00000000.136822.2847F000.00000002.mdmp") Found URL "https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stable" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/default/operation_config/default.json" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/ntp.8d73e3f1.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://authint.bcentral.cn" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/pdf.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/sidepane.d5bcd879.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/bilibili.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/youtube.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-consumer-static.azureedge.net/edropstatic/2025/02/25/1/static/css/main.2a8c2845.css" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-consumer-static.azureedge.net/edropstatic/2025/02/25/1/static/js/main.915ce316.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://earth.google.com" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://www.figma.com" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://map.baidu.com" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://maps.gaode.com" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://app.diagrams.net" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-consumer-static.azureedge.net/screenshot/2025/index.6bfeeb46d8664a1f.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "https://edge-consumer-static.azureedge.net/screenshot/2025/index.8147d939d9ed09c5.js" - Source: "00000000-00007916.00000000.136822.FB3D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008084.00000000.136469.51F30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008084.00000001.137410.51F30000.00000004.mdmp") Found URL "https://ioc.exchange/api/v1/accounts/116089313715962613ice\afd\endpoirpc-13a6e28d835b687b89enclaveubject" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://ruruurururururu.ru:8880/ca05c4078edf29e7bcba35708251196ec9ac25035dda3c78f17962c0697367caerisign" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://ruruurururururu.ru:8880/ca05c4078edf29e7bcba35708251196ec9ac25035dda3c78f17962c0697367calmemh0" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpora1>0<" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c37gxg" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008084.00000001.137410.51FA3000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/firefox/customize/title:" - Source: "00000000-00008084.00000001.137410.53C00000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/contribute/title:" - Source: "00000000-00008084.00000001.137410.53C00000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/about/title:" - Source: "00000000-00008084.00000001.137410.53C00000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/firefox/central/title:" - Source: "00000000-00008084.00000001.137410.53C00000.00000004.mdmp") Found URL "https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://www.microsoft.com/key:" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://www.microsoft.com/edge/welcome?form=mt00ljtitle:" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/edge/welcome?form=mt00lj&cs=3433859622title:" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://app.vssps.visualstudio.com/_signin?realm=my.visualstudio.com&reply_to=https%3a%2f%2fmy.visualstudio.com%2fbenefits%3fwt.mc_id%3do" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://msdn.microsoft.com/en-us/subscriptions/aa336858.aspxtitle:" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://app.vsaex.visualstudio.com/profile/view?mkt=en-us&campaign=o" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://app.vsaex.visualstudio.com/profile/create?mkt=en-us&campaign=o" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://app.vsaex.visualstudio.com/go/profile?mkt=en-us&wt.mc_id=o" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://crowdstrike.okta.com/login/sessioncookieredirect?checkaccountsetupcomplete=true&token=201119kdbkvd6aezis57iee2yyja-yhvjurpmodedmtghfvypcxtsia&redirecturl=https%3a%2f%2fcrowdstrike.okta.com%2fapp%2foffice365%2fexk9ntkuo6uni5bgc0x7%2fsso%2fwsfed%2fpassive%3fclient-request-id%3d83173841-dff5-4402-80b3-8252df4557b8%26wa%3dwsignin1.0%26wtrealm%3durn%253afederation%253amicrosoftonline%26wctx%3dloginoptions%253d3%2526estsredirect%253d2%2526estsrequest%253drqiiazvsz2sturdoztoybseigokxhpic1n3se_vrzshqqbtjqvotapesnrtvk012923fe5vegkeuxgpx6fhbq7zppfgneoq5l4jera-kihj0vfekgsiwmdpf8m18mxdkoaknyjqapws4ngj0cbqd2ohiusbwogv7rtwwtbub1oumbgztokflsy109ug3o_zq_dcpbh6t3d6fs5cgnkfmqdfdnfxhjkvmhycscypgmz8kqkfiepef_qt7ybivsqes9egs5vkk0ogtiwmofhcyimfouefat1cqnkefgkzp99bh_tt1vsyh8ngrgu7ir_nfgnc4mxlgn8qp8hs7udz8xe3i6r_cnyrt6g6xk-bpoat6qwrbwv7eiyp9ilxksrbgukq34xgv6qs4utjwhdaeq7hxdx2riroybxw2zqjtdrxjmahat--kmpbxs2xgmlbxaqiqqg1ymgomkdqr0m2btd08tqww0wylmas9phvhjgsd3trrcuk83pwxnezy5fczyjdx-zjgcrflukxowsqne6ymmndfyuuxauysd_l52kwessmxpmtfo2tim07det5w4kagfsyc1gsnvcov5c7llnpfc9kzbxh-l-9lnzfu3vp5cflj8vxtofd2ot65uh1zm_7wvrtz6g_xhtpodisgny2d1s7owgp2t29c6vb-sb1uak3ogl2itfcsfilkj0_k3iz-1_mcls8idzgi2qqwlwf0oouy6m4p0%26cbcxt%3d%26username%3dmarc.rivero%2540crowdstrike.com%26mkt%3d%26lc%3dtitle:" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "http://www.google.com/title:" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "http://google.com/title:" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://www.mozilla.org/privacy/firefox/title:" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "https://www.google.com/fnamespace-87e2b800_87dd_4c08_acc2_eb9fefd6811f-https://www.google.com/vnext-map-idfnamespace-34805c29_8d66_48d9_977c_d318f2079490-https://www.google.com/next-map-id]namespace-34805c29_8d66_48d9_977c_d318f2079490-https://ogs.google.com/^0chrome://new-tab-page]namespace-34805c29_8d66_48d9_977c_d318f2079490-https://ogs.google.com/^0chrome://new-tab-pagefnamespace-34805c29_8d66_48d9_977c_d318f2079490-https://www.google.com/next-map-idfnamespace-b5fe084e_7d14_4e1c_9405_e42312450dd1-https://www.google.com/fnamespace-b5fe084e_7d14_4e1c_9405_e42312450dd1-https://www.google.com/" - Source: "00000000-00008084.00000001.137410.53CD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008084.00000001.137410.54440000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008084.00000001.137410.54440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008084.00000001.137410.54440000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008084.00000001.137410.54440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008084.00000001.137410.54440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008084.00000001.137410.54440000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008084.00000001.137410.54440000.00000004.mdmp") Found URL "http://www.w3.org/https://www.w3.org/cf.turnstile.usb_wiz.google_adsensegoogle_ama__gcl_goog:cached:st_shares_st_cch_st_prf_nrba_taboolasc_medium__uetsid_uetvid_grecaptchac_imp_li_ads_gespsk-snowplowoutqueueadoricid5idpanoramaid_pubcid_oz_bandwidth_hjuser_cc_id_boomr___tea_wzrk_slardaramp_unsent__etm_evt_server_setdwhclickonmodelbtuserajs_sa-user-id_ym__qcses_pcrprs_psegs_psspsshowversiontime_countshowslb_showtime_69ab.storage.criteo_rtbhouse__rtbh.auhadronauhalo_lc2_com.adobe.reactor._chartbeat_cb_svref_cb_expires33acrossid_6sensebanzai:csm-pbjs-onesignal-tgt:tlm:obf-statsig.usi_u_sclidtealium_izootogooglesyndication.comyoutube.commsn.com://ads.learn.microsoft.commicrosoftedge.microsoft.comwww.bing.comgrammarly.comtaboola.comdoubleclick.net\" (Indicator: \"SHA512\"; Source: \"00000000-00002312.00000000.136542.84617000.00000002.mdmp, 00000000-00002312.00000000.136542.EF1BD000.00000002.mdmp\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp, 00000000-00007916.00000000.136822.EF101000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008084.00000000.136469.54510000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008084.00000001.137410.5450D000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008084.00000001.137410.56040000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002312.00000000.136542.6D7D0000.00000020.mdmp, 00000000-00002312.00000000.136542.6FF50000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$32","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.05222","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$33","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$34","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"youtube.com\" (Indicator: \"youtube.com\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$35","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"::GetUserNameW\" (Source: \"00000000-00002312.00000000.136542.84617000.00000002.mdmp, 00000000-00002312.00000000.136542.EF1BD000.00000002.mdmp\")\n Found string \"BIOSVersion\" (Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp, 00000000-00007916.00000000.136822.EF101000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002312.00000000.136542.84617000.00000002.mdmp, 00000000-00002312.00000000.136542.EF1BD000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002312.00000000.136542.84617000.00000002.mdmp, 00000000-00002312.00000000.136542.EF1BD000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005144.00000003.145824.73C48000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp, 00000000-00007916.00000000.136822.EF101000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp, 00000000-00007916.00000000.136822.EF101000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History\" (Source: \"00000000-00008084-00000C2D-35754715721\")\n Found string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History\" (Source: \"00000000-00008084-00000C2D-35788121065\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002312.00000000.136542.84617000.00000002.mdmp, 00000000-00002312.00000000.136542.EF1BD000.00000002.mdmp\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp, 00000000-00007916.00000000.136822.EF101000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002312.00000000.136542.84617000.00000002.mdmp, 00000000-00002312.00000000.136542.EF1BD000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002312.00000000.136542.84617000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp, 00000000-00007916.00000000.136822.EF101000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"FILE_START:%s/%s/Cookies.txt\" (Indicator: \"/cookies\"; Source: \"00000000-00002312.00000000.136542.6D7D0000.00000020.mdmp, 00000000-00002312.00000000.136542.6FF50000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00007916.00000000.136822.2847F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetNativeSystemInfo\" in file \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\"\n Found system information discovery API: \"GetEnvironmentStrings\" in file \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\"\n Found system information discovery API: \"ExpandEnvironmentStringsA\" in file \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00005144.00000003.145824.73C48000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00005144.00000003.145824.73C48000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69df734b703a3ce340092952"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"