24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 84:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample fdc7ea766a91… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fdc7ea766a91…. Malware family: Malware. Threat score 100/100. 6/28 AV engines flagged this file. 18 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fdc7ea766a91f88ecef70d8c9d8f6225158f24626678e09e5f2e82d9778e592c","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","fdc7ea766a91f88ecef70d8c9d8f6225158f24626678e09e5f2e82d9778e592c"],"about":{"@type":"SoftwareApplication","name":"810a3fb2be61b94ed08de729c6ff0d0e.exe","applicationCategory":["peexe","executable"],"identifier":"fdc7ea766a91f88ecef70d8c9d8f6225158f24626678e09e5f2e82d9778e592c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":18,"suspicious":30},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,"810a3fb2be61b94ed08de729c6ff0d0e.exe" called "FindResourceA" with parameter "2293020" - (UID: 00000000-00003600) "810a3fb2be61b94ed08de729c6ff0d0e.exe" called "FindResourceA" with parameter "16323272" - (UID: 00000000-00003600) "810a3fb2be61b94ed08de729c6ff0d0e.exe" called "FindResourceA" with parameter "16323280" - (UID: 00000000-00003600) "810a3fb2be61b94ed08de729c6ff0d0e.exe" called "FindResourceA" with parameter "16323308" - (UID: 00000000-00003600) "KL2cW94.exe" called "FindResourceA" with parameter "2684968" - (UID: 00000000-00002832) "KL2cW94.exe" called "FindResourceA" with parameter "922312" - (UID: 00000000-00002832) "KL2cW94.exe" called "FindResourceA" with parameter "922320" - (UID: 00000000-00002832) "KL2cW94.exe" called "FindResourceA" with parameter "922348" - (UID: 00000000-00002832) "KL2cW94.exe" called "FindResourceA" with parameter "922376" - (UID: 00000000-00002832) "DA7yJ97.exe" called "FindResourceA" with parameter "1310104" - (UID: 00000000-00002872) "DA7yJ97.exe" called "FindResourceA" with parameter "14422728" - (UID: 00000000-00002872) "DA7yJ97.exe" called "FindResourceA" with parameter "14422736" - (UID: 00000000-00002872) "DA7yJ97.exe" called "FindResourceA" with parameter "14422764" - (UID: 00000000-00002872)26:Ta7e,"810a3fb2be61b94ed08de729c6ff0d0e.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16369744'}" (UID: 00000000-00003600) "810a3fb2be61b94ed08de729c6ff0d0e.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16369776'}" (UID: 00000000-00003600) "810a3fb2be61b94ed08de729c6ff0d0e.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16369760'}" (UID: 00000000-00003600) "KL2cW94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '968784'}" (UID: 00000000-00002832) "KL2cW94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '968816'}" (UID: 00000000-00002832) "KL2cW94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '968800'}" (UID: 00000000-00002832) "KL2cW94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '968720'}" (UID: 00000000-00002832) "DA7yJ97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14469200'}" (UID: 00000000-00002872) "DA7yJ97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14469232'}" (UID: 00000000-00002872) "DA7yJ97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14469216'}" (UID: 00000000-00002872) "DA7yJ97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14469184'}" (UID: 00000000-00002872) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862368'}" (UID: 00000000-00003040) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862336'}" (UID: 00000000-00003040) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862384'}" (UID: 00000000-00003040) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862432'}" (UID: 00000000-00003040) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862304'}" (UID: 00000000-00003040) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862416'}" (UID: 00000000-00003040) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862448'}" (UID: 00000000-00003040) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862400'}" (UID: 00000000-00003040) "hO8sc43.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14862352'}" (UID: 00000000-00003040) "1mY48xi6.exe" called "LoadResource with parameter {'hModule': '1895366656', 'hResInfo': '1895543304'}" (UID: 00000000-00003132) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1763704832', 'hResInfo': '1764745592'}" (UID: 00000000-00002900)27:T527,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")28:T995,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")29:T411,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") file/memory contains long string with (Indicator: "Aes"; File: "SSL") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp")2a:Td30,"AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d97c73a86380768ce089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "w6640PC0a51MiE6O3+0j5wbPQSU0ssXLuHM9PYZTqxu4o7Lw0JRLvzqqdK7rwS7tJu9hBRbBoOmCU0lP8zaHFsmOmPDQlgr5brJu6L6BUIIqwksFFJLl6d0LHwemCKYR446Y8NCUEJBGqG6u/80DxybtJEsWiOXp3RlfXOoxynCs3tSzmNgM9SnrKu+zgEaCY64rS13fraaaXzA3pnOLO+OOmPDS0RG/dqhsw7qZQqpnvCoHObjl65hTHR37f6YR446Y" "cchString": "16956" "dwFlags": "1" "pcbBinary": "ab310000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "w6640PC0a51MiE6O3+0j5wbPQSU0ssXLuHM9PYZTqxu4o7Lw0JRLvzqqdK7rwS7tJu9hBRbBoOmCU0lP8zaHFsmOmPDQlgr5brJu6L6BUIIqwksFFJLl6d0LHwemCKYR446Y8NCUEJBGqG6u/80DxybtJEsWiOXp3RlfXOoxynCs3tSzmNgM9SnrKu+zgEaCY64rS13fraaaXzA3pnOLO+OOmPDS0RG/dqhsw7qZQqpnvCoHObjl65hTHR37f6YR446Y" "cchString": "16956" "dwFlags": "1" "pbBinary": "c3aeb8d0f0b46b9d4c884e8edfed23e706cf412534b2c5cbb8733d3d8653ab1bb8a3b2f0d0944bbf3aaa74aeebc12eed26ef610516c1a0e98253494ff3368716c98e98f0d0960af96eb26ee8be8150822ac24b051492e5e9dd0b1f07a608a611e38e98f0d094109046a86eaeffcd03c726ed244b1688e5e9dd195f5cea31ca70acded4b398d80cf529eb2aefb380468263ae2b4b5ddfada69a5f3037a6738b3be38e98f0d2d111bf76a86cc3ba9942aa67bc2a0739b8e5eb98531d1dfb7fa611e38e98f0d094109046a86eaeffcd03c726ed244b1688e5e9d6185f54ee35c97eacc9d9b591db0ef520ed28e0b482478563a9265553d9aba59a5f3037a6738b3be38e98f0d2d111bf76a86cc3ba9942aa67bc2a0739b8e5eb98531d1dfb7fa611e38e98f0d094109046a86eaeffcd03c726ed244b1688e5e9dd145754e239c96ba4c2d1b398d008f222ec2cedbd894d8563aa315553d6b5a39a5f3037a6738b3be38e98f0d2d111bf76a86cdaad9850932698204958d7b1e9b5791d1da6738b3bbe82b5dad0944bbd6ca83583d5cd03c726ef61051490a0a59a491d1fef31c57ea9cadeba9dd900ed2fe622feba8f488b6ba12a4a51ddaca3d715585ea47fa611e38e98f0d0944bbd6eed34ace5cd01b374a02f695ddcaee9b5791d1da6738b3bbe82b5dad0944bbd6ca83583d5cd03c726ef61051490a0a59a491d1fe03dc173aec5d0b89ddf09f727e32fecb189408968a0264453dda2a9d616585ea47fa611e38e98f0d0944bbd6eed34ace5cd01b569a1284b14e5a4a7d416491f8b598b3be38e98f08d9866976ca86eaeffcd58ea0cef61051492e5eb98515853a4698b39a5c6dabf98dd06fc29e42ce1b79d498564a325465ad5a6a5d9035359e937c16be182b5dad0944bbd6ca86eaefd8859c53cef63675ddca4a5db161d7eee32c275e3f9d9bc9cd11fbf41826eaeffcd03c77be34c2f1492e5eb985346308c738b3be38e98f0d0960ef36eb26eacb98b4d8563a327415bd7aca4d0165356ec3ac975aecfdcba99d103f724e924ecfdc12eed26ef61051492e5eb9a16471fbc738942acdcd7b9d2b961bd6ca86eaeff900fea0cef61051492e5b0b5791d1da6738b3be38e9ab59e9651bd6ee22ceabe82408963a6284c5adfafa9d21f5a5cea3bc87eafc9dab59ad905f428aa6283d5cd03c726ef61051490a0b19a491d1fc83acd6fba8cb5dad0944bbd6ca833a2d2e703c726ef61054fbfcfeb98531d1da6738b39a6c09aead0960afb2eeb2ce4af8f538167ab2d4e59daa8a8d41b5658e33ccf76a2c3dbb69cd749b141826eaeffcd03c726ef63404e90ffeb9a3e5c49ee71a611e38e98f0d09416b141826eaeffcd03c77dc24b051492e5eb98531d1fe33d8921e38cd0be96d505f622e72de8ba82458562ab26465dd8aba6d01d5b53ed37c57a" "pcbBinary": "ab310000"}2b:T147e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-40-000E2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-40-000E2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-78-000E5C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-78-000E5C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-33-000E2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-33-000E2F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-77-000E2773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-77-000E2773 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002832-35137-31-000E2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002832-35137-31-000E2390 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002832-35137-83-000E7155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002832-35137-83-000E7155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002832-35137-83-000E7155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002832-35137-83-000E7155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002832-35137-83-000E7155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-26-000E24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-26-000E24E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-66-000E2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-66-000E2630 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002832-35137-36-000E3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002832-35137-36-000E3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-57-000E6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-57-000E6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-59-000E621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-59-000E621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-52-000E4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-52-000E4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-37-000E3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-37-000E3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-44-000E2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-44-000E2AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-60-000E597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-60-000E597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-15-000E1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-15-000E1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-42-000E202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00002832-35137-42-000E202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-42-000E202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-71-000E2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-71-000E2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-62-000E55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-62-000E55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-16-000E44B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-16-000E44B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-73-000E17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-73-000E17EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-29-000E52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-29-000E52B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-43-000E1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-43-000E1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-41-000E6495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-41-000E6495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002832-35137-63-000E5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002832-35137-63-000E54672c:T78e1,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "43Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=sktUzA9Injs4zvoxUgtBContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 12 Nov 2023 02:56:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEArsgblXx1gfjQv1Tw5VS%2BM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2d:T53e,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: PCAP contains base64 strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2e:T2c82,"810a3fb2be61b94ed08de729c6ff0d0e.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003600) "KL2cW94.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002832) "DA7yJ97.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002872) "hO8sc43.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003040) "1mY48xi6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96c70ddd90266ffcc0499ffff04ccffff0460ddd9020000c96c0000000001000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e1aa6afe518e4d9022a9df8760000000024830d7704000000000000000000000094f5d90200000000e79cf876020007802cded90200000000760000007cded902feffffff04ded902cf003777d60037778fcde875760000003b0000007cded9026f006e00d8ddd9026e00740040ded902 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96ca0e2ef0266ffcc0499ffff04ccffff0490e2ef020000c96c0000000001000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96c60e03e0466ffcc0499ffff04ccffff0450e03e040000c96c0000000001000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96c30e43f0466ffcc0499ffff04ccffff0420e43f040000c96c0000000001000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96c40e1ec0266ffcc0499ffff04ccffff0430e1ec020000c96c0000000001000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96c60e2e20266ffcc0499ffff04ccffff0450e2e2020000c96c0000000001000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96c70ddea0266ffcc0499ffff04ccffff0460ddea020000c96c0000000001000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96cd0e0e80266ffcc0499ffff04ccffff04c0e0e8020000c96c0000000001000000 (UID: 00000000-00003132) "1mY48xi6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000c96c90e0d90266ffcc0499ffff04ccffff0480e0d9020000c96c0000000001000000 (UID: 00000000-00003132) "2my3787.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000364)2f:T1655,"1mY48xi6.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003132) "AppLaunch.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003352) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003352) "AppLaunch.exe" called "GetVersionExA" (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310039c8f4e707b29c1f773437d06d00000000010000000000000001000000ecf4e707000000002812ee0128f5e70738bf7200f8f4e7078f9c1f773437d06d02000000000000001800000001000000fcf4e7072823406600006300000000000c0000002042040208f5e7072f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077b05a3d04e05e3e0400000000b05a3d04100000000000000030ed240050dc1577b05a3d041000000064af3c04540ace00100000005ced2400a6ec0b7002000000000000001800000028c70b7060ed24002823406600006300000000000c00000028c70b706ced24002f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000058ee24006a6f736600000000bc6f7366754fde3ed4e924000000000040f3240015de4c773167b449feffffff7f675477e2d82e772824b46e02000000000000001800000030a5d06d18ee24002823406600006300000000000c00000030a5d06d24ee24002f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077b05a3d04e05e3e0400000000b05a3d04100000000000000008e8240050dc1577b05a3d0410000000ec443b049436d0001000000034e82400a6ec0b7002000000000000001800000028c70b7038e824002823406600006300000000000c00000028c70b7044e824002f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000054e924006a6f736600000000bc6f7366714ade3ed0e424000000000040f3240015de4c773167b449feffffff7f675477e2d82e772824b46e02000000000000001800000030a5d06d14e924002823406600006300000000000c00000030a5d06d20e924002f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007b389616c68063b0400000000c0f0fb07a826616c68063b0408f1fb070723606c68063b0420000000000000005c37606c2812ee0120c206022812ee0102000000000000001800000000063b040cf1fb072823406600006300000000000c00000020c2060218f1fb072f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008b389616cb013400400000000f0f00408a826616cb013400438f104080723606cb013400420000000000000005c37606c2812ee01d0e61c022812ee01020000000000000018000000001340043cf104082823406600006300000000000c000000d0e61c0248f104082f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000014ed24006a6f736600000000bc6f7366314ede3e90e824000000000040f3240015de4c773167b449feffffff7f675477e2d82e772824b46e02000000000000001800000030a5d06dd4ec24002823406600006300000000000c00000030a5d06de0ec24002f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077b05a3d04e05e3e0400000000b05a3d041000000000000000c8eb240050dc1577b05a3d0410000000ec443b04b49ed00010000000f4eb2400a6ec0b7002000000000000001800000028c70b70f8eb24002823406600006300000000000c00000028c70b7004ec24002f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000004ed24006a6f736600000000bc6f7366014ede3e80e824000000000040f3240015de4c773167b449feffffff7f675477e2d82e772824b46e02000000000000001800000030a5d06dc4ec24002823406600006300000000000c00000030a5d06dd0ec24002f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077b05a3d04e05e3e0400000000b05a3d041000000000000000dceb240050dc1577b05a3d0410000000ec443b04ec36d0001000000008ec2400a6ec0b7002000000000000001800000028c70b700cec24002823406600006300000000000c00000028c70b7018ec24002f99d06d0c000000 (UID: 00000000-00002900) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006c781440040000000038f23308a826616c7814400484f233080723606c7814400420000000000000005c37606c2812ee0120021f022812ee0120021f020200000000000000180000009903a77d88f233082823406600006300000000000c00000020021f0294f233082f99d06d0c000000 (UID: 00000000-00002900)30:T467,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")31:T6f8,"810a3fb2be61b94ed08de729c6ff0d0e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "810a3fb2be61b94ed08de729c6ff0d0e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "KL2cW94.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "KL2cW94.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "DA7yJ97.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "DA7yJ97.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "hO8sc43.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "hO8sc43.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1mY48xi6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1mY48xi6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2my3787.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2my3787.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7HU39eh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "8An127IW.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:T493,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")33:T470,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")34:T467,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")35:T4f0,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")36:T74a,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")37:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")38:T574,"AppLaunch.exe" queries volume information of "C:\" at 00000000-00003352-0000010C-697558 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00002900-0000010C-20700650 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002900-0000010C-49219950 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002900-0000010C-49694326 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002900-0000010C-54979252 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002900-0000010C-55015511 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002900-0000010C-57696632 "AppLaunch.exe" queries volume information of "C:\" at 00000000-00003308-0000010C-1584618839:T6a2,"hO8sc43.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00003040) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003352) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003352) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003352) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003352) "AppLaunch.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003352) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003352) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002900) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002900) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00002900) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003308) "AppLaunch.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003308) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003308) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003308) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003308)3a:T441f,"810a3fb2be61b94ed08de729c6ff0d0e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003600) "KL2cW94.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002832) "KL2cW94.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002832) "KL2cW94.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002832) "KL2cW94.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002832) "KL2cW94.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002832) "DA7yJ97.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002872) "hO8sc43.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003040) "hO8sc43.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003040) "hO8sc43.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003040) "hO8sc43.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003040) "hO8sc43.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003040) "hO8sc43.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003040) "hO8sc43.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003040) "1mY48xi6.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00003132) "1mY48xi6.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00003132) "2my3787.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000364) "2my3787.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000364) "2my3787.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000364) "2my3787.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000364) "2my3787.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000364) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003352) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002900) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00002900) "9wm6Fw9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002152) "9wm6Fw9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002152) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003308) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003308)3b:T12857,"810a3fb2be61b94ed08de729c6ff0d0e.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003600) "810a3fb2be61b94ed08de729c6ff0d0e.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003600) "KL2cW94.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002832) "KL2cW94.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002832) "DA7yJ97.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002872) "DA7yJ97.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002872) "DA7yJ97.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002872) "DA7yJ97.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002872) "hO8sc43.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003040) "hO8sc43.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003040) "1mY48xi6.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003132) "1mY48xi6.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003132) "2my3787.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000364) "2my3787.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000364) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003352) "AppLaunch.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00003352) "7HU39eh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002024) "7HU39eh.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002024) "7HU39eh.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002024) "8An127IW.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003988) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002900) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002900) "9wm6Fw9.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002152) "9wm6Fw9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002152) "9wm6Fw9.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002152) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetOpenW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpOpenRequestW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003308) "AppLaunch.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003308)3c:T15ea,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00003040.00000BE0.6367747.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000364.00000000.66975.00DC0000.00000004.mdmp, 00000000-00000364.00000000.66984.00350000.00000004.mdmp, 00000000-00000364.00000000.66984.00360000.00000004.mdmp, 00000000-00000364.00000000.66984.003C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000364.00000000.66984.00350000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000364.00000000.66984.003C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00000364.00000000.66984.003C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002024.00000000.67392.00550000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002024.00000000.67392.00550000.00000004.mdmp, 00000000-00002024.00000000.67392.00800000.00000004.mdmp, 00000000-00002024.00000000.67392.00AE0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002152.00000000.69282.004E0000.00000004.mdmp, 00000000-00002152.00000000.69282.00AA0000.00000004.mdmp, 00000000-00002152.00000000.69282.00E90000.00000004.mdmp, 00000000-00002152.00000001.69572.004E0000.00000004.mdmp, 00000000-00002152.00000001.69572.00AA0000.00000004.mdmp, 00000000-00002152.00000001.69572.00E90000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002152.00000000.69282.004E0000.00000004.mdmp, 00000000-00002152.00000001.69572.004E0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00002152.00000000.69282.004E0000.00000004.mdmp, 00000000-00002152.00000001.69572.004E0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002152.00000000.69282.00AA0000.00000004.mdmp, 00000000-00002152.00000001.69572.00AA0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002152.00000001.69572.004E0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002832.00000000.65487.000C0000.00000004.mdmp, 00000000-00002832.00000002.68815.000C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002832.00000000.65487.000C0000.00000004.mdmp, 00000000-00002832.00000000.65487.00460000.00000004.mdmp, 00000000-00002832.00000000.65487.00C80000.00000004.mdmp, 00000000-00002832.00000002.68815.000C0000.00000004.mdmp, 00000000-00002832.00000002.68815.00460000.00000004.mdmp, 00000000-00002832.00000002.68815.00C80000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002832.00000000.65487.00460000.00000004.mdmp, 00000000-00002832.00000002.68815.00460000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002832.00000000.65487.00460000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002832.00000000.65487.00460000.00000004.mdmp, 00000000-00002832.00000002.68815.00460000.00000004.mdmp") Found reference to API "11156896463,2784,3136,,CreateProcessA,kernel32.dll,"252:02:32.781",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002832.00000000.65487.00460000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002872.00000000.65522.00220000.00000004.mdmp, 00000000-00002872.00000000.65522.008B0000.00000004.mdmp, 00000000-00002872.00000000.65522.00D00000.00000004.mdmp, 00000000-00002872.00000001.67442.00220000.00000004.mdmp, 00000000-00002872.00000001.67483.008B0000.00000004.mdmp, 00000000-00002872.00000001.67483.00D00000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002872.00000000.65522.00220000.00000004.mdmp, 00000000-00002872.00000001.67442.00220000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002872.00000000.65522.00220000.00000004.mdmp, 00000000-00002872.00000001.67442.00220000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002872.00000000.65522.00220000.00000004.mdmp")3d:T145af,Found reference to API (Indicator: "CheckTokenMembership"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "DecryptFileA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "FreeSid"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "EqualSid"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "RegCloseKey"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "FindNextFileA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "FindClose"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LocalAlloc"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "lstrcmpA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CompareStringA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetLastError"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "DeleteFileA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GlobalFree"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CloseHandle"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetProcAddress"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GlobalLock"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LocalFree"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "FreeLibrary"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "ReadFile"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SizeofResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "WriteFile"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetFileTime"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetFilePointer"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "FindResourceA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CreateMutexA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "FreeResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetVersion"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetTempPathA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CreateFileA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetEvent"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "TerminateThread"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetVersionExA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LockResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CreateThread"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "ResetEvent"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LoadResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "ExitProcess"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CreateProcessA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "FormatMessageA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CreateEventA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CharUpperA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "MessageBeep"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CharPrevA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "LoadStringA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CharNextA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "EnableWindow"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "ReleaseDC"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "PeekMessageA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SendMessageA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "MessageBoxA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "ShowWindow"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetWindowPos"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetDC"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetWindowRect"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "Sleep"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "TerminateProcess"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetTickCount"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "MulDiv"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API (Indicator: "GetWindowDC"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetClassName"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLong"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLong"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItem"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "LoadCursor"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "InsertMenu"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowEx"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "RegisterHotKey"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00003988.00000001.68514.001D8000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExA"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentHwProfileW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "GetAdaptersInfo"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002832.00000001.67407.000E1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002832.00000001.67407.000E1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002832.00000001.67407.000E1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")3e:T77e,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")3f:T484,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")40:T477,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000364.00000000.66975.01170000.00000002.mdmp, 00000000-00000364.00000000.66975.01178000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002152.00000000.69282.00120000.00000002.mdmp, 00000000-00002152.00000001.69572.00128000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002832.00000001.67407.000EA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002872.00000001.67442.00DCA000.00000002.mdmp")41:T56b,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 810a3fb2be61b94ed08de729c6ff0d0e.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: 810a3fb2be61b94ed08de729c6ff0d0e.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 810a3fb2be61b94ed08de729c6ff0d0e.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 810a3fb2be61b94ed08de729c6ff0d0e.exe "System\CurrentControlSet\Control\Session Manager" in Source: 27447-17-0040256D "%APPDATA%\Opera Software\*" in Source: 00000000-00002900-00000C28-129333202946 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00002900-00000C28-129575412272 "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000364.00000000.66984.003C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002152.00000001.69572.004E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002832.00000000.65487.00460000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002832.00000001.67407.000E1000.00000020.mdmp42:T534,"\Sessions\1\BaseNamedObjects\IsoScope_da8_IESQMMUTEX_0_519" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3496" "Local\!BrowserEmulation!SharedMemory!Mutex" "IsoScope_da8_IESQMMUTEX_0_519" "UpdatingNewTabPageData" "Local\VERMGMTBlockListFileMutex" "Local\ZonesCacheCounterMutex" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_da8_IE_EarlyTabStart_0xbf4_Mutex" "IsoScope_da8_ConnHashTable<3496>_HashTable_Mutex" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "Local\ZonesLockedCacheCounterMutex" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3496" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_da8_IE_EarlyTabStart_0xbf4_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_da8_ConnHashTable<3496>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}"43:Teaa,"KL2cW94.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "KL2cW94.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "hO8sc43.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "hO8sc43.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1mY48xi6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1mY48xi6.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "2my3787.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "2my3787.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2my3787.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "9wm6Fw9.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "Wtsapi32" - [base:6c5d44b4; Status:c0000135]44:T4d3,"810a3fb2be61b94ed08de729c6ff0d0e.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "KL2cW94.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "DA7yJ97.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "hO8sc43.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "9wm6Fw9.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "8An127IW.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2my3787.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT45:Ta3e,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "810a3fb2be61b94ed08de729c6ff0d0e.exe") file/memory contains long string with (Indicator: "twitter"; File: "VGG0A8IL.txt") file/memory contains long string with (Indicator: "twitter"; File: "T24IUPBD.txt") Found string "guest_id_marketingv1%3A169975959980892596twitter.com/1025425833305631216314252793693231069458guest_id_adsv1%3A169975959980892596twitter.com/10254258333056312163143509463631069459" (Indicator: "twitter"; File: "0157FLBQ.txt") Found string "CheckConnectionTempCookie728271720accounts.youtube.com/accounts/2147484752180091417631069469170898417631069469" (Indicator: "youtube"; File: "B0UB5CGA.txt") Found string "guest_id_marketingv1%3A169975959980892596twitter.com/1025425833305631216314252793693231069458" (Indicator: "twitter"; File: "WSTB346G.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "6QF03SW9.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "function DynamicLink_PlayYouTubeVideoInline( elem, videoid )" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var youtubeurl = location.protocol + '//www.youtube.com/embed/' + videoid + '?showinfo=0&autohide=1&fs=1&hd=1&modestbranding=1&rel=0&showsearch=0&wmode=direct&autoplay=1';" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var wrapper = $J( '

', { 'class': 'dynamiclink_youtubeviewvideo' } );" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var embed_wrapper = $J( '

', { 'class' : 'dynamiclink_youtubeviewvideoembedded', 'frameborder' : '0' } );" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var iframeContent = $J( '