26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 94:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 0b3a82c1a567… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0b3a82c1a567…. Malware family: Crifi.Generic. Threat score 100/100. 11/25 AV engines flagged this file. 19 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":19,"suspicious":30},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T48b,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindResourceA" with parameter "14095056" - (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindResourceA" with parameter "14095096" - (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindResourceA" with parameter "14095112" - (UID: 00000000-00003944) "Ll8cp20.exe" called "FindResourceA" with parameter "332496" - (UID: 00000000-00002292) "Ll8cp20.exe" called "FindResourceA" with parameter "332536" - (UID: 00000000-00002292) "Ll8cp20.exe" called "FindResourceA" with parameter "332552" - (UID: 00000000-00002292) "UU5HX65.exe" called "FindResourceA" with parameter "11801420" - (UID: 00000000-00004044) "UU5HX65.exe" called "FindResourceA" with parameter "1308928" - (UID: 00000000-00004044) "UU5HX65.exe" called "FindResourceA" with parameter "11801288" - (UID: 00000000-00004044) "UU5HX65.exe" called "FindResourceA" with parameter "11801296" - (UID: 00000000-00004044) "UU5HX65.exe" called "FindResourceA" with parameter "11801324" - (UID: 00000000-00004044)28:Ta01,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14141552'}" (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14141504'}" (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14141456'}" (UID: 00000000-00003944) "Ll8cp20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '378992'}" (UID: 00000000-00002292) "Ll8cp20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '378944'}" (UID: 00000000-00002292) "Ll8cp20.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '378896'}" (UID: 00000000-00002292) "UU5HX65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11847648'}" (UID: 00000000-00004044) "UU5HX65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11847760'}" (UID: 00000000-00004044) "UU5HX65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11847792'}" (UID: 00000000-00004044) "UU5HX65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11847776'}" (UID: 00000000-00004044) "UU5HX65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11847744'}" (UID: 00000000-00004044) "UU5HX65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11847696'}" (UID: 00000000-00004044) "bk3UW74.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3459184'}" (UID: 00000000-00001644) "bk3UW74.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3459136'}" (UID: 00000000-00001644) "bk3UW74.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3459088'}" (UID: 00000000-00001644) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1762459648', 'hResInfo': '1763500408'}" (UID: 00000000-00004404) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1762459648', 'hResInfo': '1763500392'}" (UID: 00000000-00004404) "5yy8rn9.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4296976'}" (UID: 00000000-00004788) "5yy8rn9.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4296944'}" (UID: 00000000-00004788) "5yy8rn9.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4296960'}" (UID: 00000000-00004788)29:T10f1,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")2a:T501,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000512.00000001.118643.00B12000.00000020.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")2b:Taa0,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")2c:T549,Found string "G"5Dv(FABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found string "G"5Dv(FABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00002936.00000B78.929268.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00002936.00000B78.929268.00401000.wprm") Found string "G"5Dv(FABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found string "G"5Dv(FABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp")2d:T792,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\OBJECTS\{871C5380-42A0-1069-A2EA-08002B30309D}") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "cmd.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32")2e:T663,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003944-50391-7-00D76F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003944-50391-10-00D76CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002292-50882-7-00056F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002292-50882-10-00056CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004044-51569-7-00B46F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004044-51569-10-00B46CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004512-53123-420-002767D5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004512-53123-496-00278DF3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004512-53123-804-002765BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004512-53123-1501-00276720 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002448-54058-1274-00C167D5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002448-54058-1350-00C18DF3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002448-54058-1658-00C165BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002448-54058-2470-00C16720 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001684-60246-955-00B967D5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001684-60246-1031-00B98DF3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001684-60246-1339-00B965BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001684-60246-2097-00B96720 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004788-61256-74-00409FD0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004788-61256-75-00409FB02f:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-15-00D71F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-15-00D71F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-16-00D744B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-16-00D744B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-22-00D7681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-22-00D7681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-26-00D724E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-26-00D724E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-29-00D752B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-29-00D752B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003944-50391-31-00D72390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003944-50391-31-00D72390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-33-00D72F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-33-00D72F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003944-50391-36-00D73BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003944-50391-36-00D73BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-37-00D73FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-37-00D73FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-40-00D72267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-40-00D72267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-41-00D76495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-41-00D76495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-42-00D7202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00003944-50391-42-00D7202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-42-00D7202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-43-00D71AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-43-00D71AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-44-00D72AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-44-00D72AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-52-00D74EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-52-00D74EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-57-00D76298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-57-00D76298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-59-00D7621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-59-00D7621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-60-00D7597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-60-00D7597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-62-00D755A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-62-00D755A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-63-00D75467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-63-00D75467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-65-00D753A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-65-00D753A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-66-00D72630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-66-00D72630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-71-00D72CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-71-00D72CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-72-00D718A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-72-00D718A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003944-50391-73-00D717EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003944-50391-73-00D717EE30:T44c,Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp, 00000000-00002292.00000001.119653.001E0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003944.00000000.118460.00310000.00000004.mdmp, 00000000-00003944.00000001.119988.00310000.00000004.mdmp")31:T215a,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 03:35:49 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 03:35:49 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 03:35:49 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 03:35:49 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 03:35:49 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 00:09:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 00:09:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 00:09:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 00:09:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 11 Aug 2026 00:09:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"32:T43f,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]33:T3054,Found XOR loop in file "Ll8cp20.exe" at offset 192835; code bytes = 30d0 Found XOR loop in file "Ll8cp20.exe" at offset 257304; code bytes = 30d0 Found XOR loop in file "Ll8cp20.exe" at offset 360384; code bytes = 30d0 Found XOR loop in file "Ll8cp20.exe" at offset 440987; code bytes = 30d0 Found XOR loop in file "Ll8cp20.exe" at offset 529298; code bytes = 30d0 Found XOR loop in file "Ll8cp20.exe" at offset 703274; code bytes = 30d0 Found XOR loop in file "Ll8cp20.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "Ll8cp20.exe" at offset 245902; code bytes = 33c1 Found XOR loop in file "Ll8cp20.exe" at offset 323667; code bytes = 33c1 Found XOR loop in file "Ll8cp20.exe" at offset 452084; code bytes = 33c1 Found XOR loop in file "Ll8cp20.exe" at offset 506595; code bytes = 33c1 Found XOR loop in file "Ll8cp20.exe" at offset 653971; code bytes = 33c1 Found XOR loop in file "Ll8cp20.exe" at offset 726544; code bytes = 33c1 Found XOR loop in file "Ll8cp20.exe" at offset 754105; code bytes = 33c1 Found XOR loop in file "Ll8cp20.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 155729; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 161547; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 308734; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 318682; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 364644; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 396393; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 397365; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 507835; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 522354; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 525848; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 583966; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 584393; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 585206; code bytes = 8030 Found XOR loop in file "Ll8cp20.exe" at offset 743176; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 148777; code bytes = 30d0 Found XOR loop in file "UU5HX65.exe" at offset 264538; code bytes = 30d0 Found XOR loop in file "UU5HX65.exe" at offset 345092; code bytes = 30d0 Found XOR loop in file "UU5HX65.exe" at offset 433363; code bytes = 30d0 Found XOR loop in file "UU5HX65.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "UU5HX65.exe" at offset 227837; code bytes = 33c1 Found XOR loop in file "UU5HX65.exe" at offset 356189; code bytes = 33c1 Found XOR loop in file "UU5HX65.exe" at offset 410668; code bytes = 33c1 Found XOR loop in file "UU5HX65.exe" at offset 500665; code bytes = 33c1 Found XOR loop in file "UU5HX65.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 212904; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 222852; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 268798; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 300523; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 301495; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 411908; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 426419; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 429913; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 488007; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 488434; code bytes = 8030 Found XOR loop in file "UU5HX65.exe" at offset 489247; code bytes = 8030 Found XOR loop in file "4wu689py.exe" at offset 224674; code bytes = 30d0 Found XOR loop in file "4wu689py.exe" at offset 253218; code bytes = 30d0 Found XOR loop in file "4wu689py.exe" at offset 369933; code bytes = 30d0 Found XOR loop in file "4wu689py.exe" at offset 371403; code bytes = 30d0 Found XOR loop in file "4wu689py.exe" at offset 371663; code bytes = 30d0 Found XOR loop in file "4wu689py.exe" at offset 13642; code bytes = 33c1 Found XOR loop in file "4wu689py.exe" at offset 13714; code bytes = 33c1 Found XOR loop in file "4wu689py.exe" at offset 13746; code bytes = 33c1 Found XOR loop in file "4wu689py.exe" at offset 23872; code bytes = 33c1 Found XOR loop in file "4wu689py.exe" at offset 26490; code bytes = 33c1 Found XOR loop in file "4wu689py.exe" at offset 253691; code bytes = 8030 Found XOR loop in file "4wu689py.exe" at offset 254183; code bytes = 8030 Found XOR loop in file "4wu689py.exe" at offset 254375; code bytes = 8030 Found XOR loop in file "3pt32Vf.exe" at offset 140923; code bytes = 30d0 Found XOR loop in file "3pt32Vf.exe" at offset 246468; code bytes = 30d0 Found XOR loop in file "3pt32Vf.exe" at offset 270008; code bytes = 30d0 Found XOR loop in file "3pt32Vf.exe" at offset 285965; code bytes = 30d0 Found XOR loop in file "3pt32Vf.exe" at offset 287435; code bytes = 30d0 Found XOR loop in file "3pt32Vf.exe" at offset 287695; code bytes = 30d0 Found XOR loop in file "3pt32Vf.exe" at offset 13643; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 13715; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 13747; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 23872; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 26490; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 158467; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 158494; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 159589; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 164538; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173297; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173315; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173333; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173351; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173369; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173387; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173405; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173423; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173441; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173459; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173477; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173495; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173513; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173548; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173566; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173584; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173602; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 173620; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 178667; code bytes = 33c1 Found XOR loop in file "3pt32Vf.exe" at offset 178761; code bytes = 33c1 Found XOR loop in file "bk3UW74.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "bk3UW74.exe" at offset 252857; code bytes = 33c1 Found XOR loop in file "bk3UW74.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "bk3UW74.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "bk3UW74.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "bk3UW74.exe" at offset 155678; code bytes = 8030 Found XOR loop in file "bk3UW74.exe" at offset 189550; code bytes = 8030 Found XOR loop in file "bk3UW74.exe" at offset 205653; code bytes = 8030 Found XOR loop in file "2Zc0213.exe" at offset 147053; code bytes = 30d0 Found XOR loop in file "2Zc0213.exe" at offset 149915; code bytes = 30d0 Found XOR loop in file "2Zc0213.exe" at offset 173325; code bytes = 30d0 Found XOR loop in file "2Zc0213.exe" at offset 174795; code bytes = 30d0 Found XOR loop in file "2Zc0213.exe" at offset 175055; code bytes = 30d0 Found XOR loop in file "2Zc0213.exe" at offset 13643; code bytes = 33c1 Found XOR loop in file "2Zc0213.exe" at offset 13715; code bytes = 33c1 Found XOR loop in file "2Zc0213.exe" at offset 13747; code bytes = 33c1 Found XOR loop in file "2Zc0213.exe" at offset 23872; code bytes = 33c1 Found XOR loop in file "2Zc0213.exe" at offset 26490; code bytes = 33c1 Found XOR loop in file "5yy8rn9.exe" at offset 49744; code bytes = 33c1 Found XOR loop in file "5yy8rn9.exe" at offset 49766; code bytes = 33c1 Found XOR loop in file "5yy8rn9.exe" at offset 49788; code bytes = 33c1 Found XOR loop in file "5yy8rn9.exe" at offset 49860; code bytes = 33c1 Found XOR loop in file "5yy8rn9.exe" at offset 49956; code bytes = 33c1 Found XOR loop in file "5yy8rn9.exe" at offset 50065; code bytes = 33c1 Found XOR loop in file "5yy8rn9.exe" at offset 32706; code bytes = 8030 Found XOR loop in file "5yy8rn9.exe" at offset 83850; code bytes = 8030 Found XOR loop in file "1dM49pQ2.exe" at offset 2151; code bytes = 8030 Found XOR loop in file "1dM49pQ2.exe" at offset 2163; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 185706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 228692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 296332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 300312; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 353158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 455665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 536308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 624660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 798726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 237959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 295616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 341756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 409379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 547405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 601949; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 749390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 822004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 897465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 238448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 459933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 491690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 492662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 603189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 617708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 621210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 679353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 679780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 680593; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 838653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 867271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 890070; code bytes = 803034:T5db,file/memory contains long string with (Indicator: "GetCommandLine"; File: "4wu689py.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "3pt32Vf.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "2Zc0213.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "5yy8rn9.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp")35:T73c,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "bk3UW74.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001644.00000001.118983.00341000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002292.00000000.118544.00051000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003944.00000000.118460.00D71000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")36:T73e,Found system information discovery API: "ExpandEnvironmentStringsA" in file "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" Found system information discovery API: "GetSystemInfo" in file "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" Found system information discovery API: "GetEnvironmentStringsW" in file "00000000-00002448.00000000.119307.00C33000.00000004.mdmp" Found system information discovery API: "GetMonitorInfo" in file "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in file "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00001644.00000000.118622.0034A000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001644.00000000.118622.0034A000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp" Found system information discovery API: "GetMonitorInfo" in "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00002292.00000000.118544.0005A000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002292.00000000.118544.0005A000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp"37:T74d,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") file/memory contains long string with (Indicator: "sendmessage"; File: "bk3UW74.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "5yy8rn9.exe") file/memory contains long string with (Indicator: "postmessage"; File: "CheckConnection_1_.htm") Found reference to API "SendMessage" (Indicator: "sendmessage"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003144-00000C2C-879638936") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")38:T1919,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003944) "Ll8cp20.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002292) "Ll8cp20.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002292) "UU5HX65.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004044) "UU5HX65.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004044) "bk3UW74.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001644) "1dM49pQ2.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000512) "1dM49pQ2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000512) "1dM49pQ2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000290ff4b008400008400000000000000000000000080000000000000003f42007d402c4c000100000000000000020000000c000000c8ac4b00c8ac4b00c3ac4b000000000000000000000045000000000130f626000000000050fc260095e1587749b92400feffffff435c5c7750595c7794000000a0000000c2ac4b00c0ac4b0094000000d4f72600fdfe1c77b4f026000100000050fc2600a2e0756b1dfcbb82feffffff6cf726005c9c756b5c0c000080f726006f9c756b0000000000000000 (UID: 00000000-00000512)39:T5db,"1dM49pQ2.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f4ac4b0000000000000074002e004e00450054005c004600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000000000000 (UID: 00000000-00000512) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000dce21300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004404) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f45c77e00349772cea31000000cd710000cd710000000000000000f0000000f000cd710000000098e93100000000002ceb31000000000001000000fce9310040f55c770000000000000000e8e93100 (UID: 00000000-00004404) "cmd.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003144)3a:T81e,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Ll8cp20.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Ll8cp20.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "UU5HX65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "UU5HX65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "bk3UW74.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "bk3UW74.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1dM49pQ2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Zc0213.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Zc0213.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3pt32Vf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3pt32Vf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4wu689py.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4wu689py.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5yy8rn9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5yy8rn9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")3b:T45e,Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp")3c:Tcae,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "00000000-00004788.00000000.119983.00401000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "26384,4616,3024,,RtlGetVersion,NTDLL.dll,"252:16:19.881",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "150792,4400,3024,,RtlGetVersion,NTDLL.dll,"252:16:36.605",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "401160,3348,3024,,RtlGetVersion,NTDLL.dll,"252:16:18.914",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp") Found reference to API "895092,2932,3024,,RtlGetVersion,NTDLL.dll,"252:16:31.113",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found reference to API "795036,4600,3024,,RtlGetVersion,NTDLL.dll,"252:16:18.275",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003944.00000000.118460.00310000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")3d:T5b1,"1dM49pQ2.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dM49pQ2.exe" at 00000000-00000512-0000010C-1967240 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00004404-0000010C-391722 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004404-0000010C-2146309 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004404-0000010C-2151112 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004404-0000010C-2838942 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004404-0000010C-2842481 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004404-0000010C-3153709 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003144-0000010C-5582003e:T55c,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\Ll8cp20.exe" - (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\5yy8rn9.exe" - (UID: 00000000-00003944) "Ll8cp20.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\UU5HX65.exe" - (UID: 00000000-00002292) "Ll8cp20.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\4wu689py.exe" - (UID: 00000000-00002292) "UU5HX65.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\bk3UW74.exe" - (UID: 00000000-00004044) "UU5HX65.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3pt32Vf.exe" - (UID: 00000000-00004044) "bk3UW74.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2Zc0213.exe" - (UID: 00000000-00001644) "5yy8rn9.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd" /c "%TEMP%\7EC0.tmp\7ED1.tmp\7ED2.bat %TEMP%\I" - (UID: 00000000-00004788), "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00003144), "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00003144)3f:T32e7,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003944) "Ll8cp20.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002292) "UU5HX65.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004044) "1dM49pQ2.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000512) "1dM49pQ2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00000512) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004404) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00004404) "5yy8rn9.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\5yy8rn9.exe (UID: 00000000-00004788) "5yy8rn9.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00004788) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003144) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003144)40:T9eab,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003944) "Ll8cp20.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002292) "Ll8cp20.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002292) "Ll8cp20.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002292) "Ll8cp20.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002292) "Ll8cp20.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002292) "Ll8cp20.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002292) "UU5HX65.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004044) "UU5HX65.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004044) "UU5HX65.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004044) "UU5HX65.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004044) "UU5HX65.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004044) "UU5HX65.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004044) "bk3UW74.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001644) "bk3UW74.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001644) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000512) "1dM49pQ2.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000512) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002956) "3pt32Vf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002448) "3pt32Vf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002448) "3pt32Vf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002448) "3pt32Vf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002448) "4wu689py.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001684) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004404) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004404) "5yy8rn9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004788) "5yy8rn9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004788) "5yy8rn9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004788) "5yy8rn9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004788) "5yy8rn9.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004788) "5yy8rn9.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00004788) "5yy8rn9.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004788) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003144) "cmd.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003144)41:T16fb,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00004044.00000FCC.643627.00050000.wprm") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000512.00000000.118633.00330000.00000004.mdmp, 00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000000.118633.009C0000.00000004.mdmp, 00000000-00000512.00000000.118633.01C80000.00000004.mdmp, 00000000-00000512.00000001.118643.00330000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.009C0000.00000004.mdmp, 00000000-00000512.00000001.118643.01C80000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000000.118622.005D0000.00000004.mdmp, 00000000-00001644.00000000.118622.00AD0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.005D0000.00000004.mdmp, 00000000-00001644.00000001.118983.00AD0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp, 00000000-00001684.00000000.119641.00720000.00000004.mdmp, 00000000-00001684.00000000.119646.00B00000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp, 00000000-00002292.00000000.118544.00560000.00000004.mdmp, 00000000-00002292.00000000.118544.00870000.00000004.mdmp, 00000000-00002292.00000001.119653.001E0000.00000004.mdmp, 00000000-00002292.00000001.119653.00560000.00000004.mdmp, 00000000-00002292.00000001.119653.00870000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp, 00000000-00002292.00000001.119653.001E0000.00000004.mdmp") Found reference to API "361732,3348,3142,,CreateProcessA,kernel32.dll,"252:16:18.914",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp, 00000000-00002292.00000001.119653.001E0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002448.00000000.119307.00DA0000.00000004.mdmp, 00000000-00002448.00000000.119312.00180000.00000004.mdmp, 00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003944.00000000.118460.00310000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003944.00000000.118460.00310000.00000004.mdmp, 00000000-00003944.00000001.119988.00310000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003944.00000000.118460.00310000.00000004.mdmp, 00000000-00003944.00000000.118460.006A0000.00000004.mdmp, 00000000-00003944.00000000.118460.009D0000.00000004.mdmp, 00000000-00003944.00000001.119988.00310000.00000004.mdmp, 00000000-00003944.00000001.119988.006A0000.00000004.mdmp, 00000000-00003944.00000001.119988.009D0000.00000004.mdmp") Found reference to API "991902,4600,3142,,CreateProcessA,kernel32.dll,"252:16:18.290",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003944.00000000.118460.00310000.00000004.mdmp")42:T69f,Sleep@KERNEL32.DLL at 00000000-00003944-50391-11-00D76A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00003944-50391-37-00D73FEF MsgWaitForMultipleObjects at 00000000-00003944-50391-95-00D73680 Sleep@KERNEL32.DLL at 00000000-00002292-50882-11-00056A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00002292-50882-37-00053FEF MsgWaitForMultipleObjects at 00000000-00002292-50882-95-00053680 Sleep@KERNEL32.DLL at 00000000-00004044-51569-11-00B46A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00004044-51569-37-00B43FEF MsgWaitForMultipleObjects at 00000000-00004044-51569-95-00B43680 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004512-53123-637-00275EFE SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00004512-53123-774-002752B2 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00002448-54058-1491-00C15EFE SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00002448-54058-1628-00C152B2 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00001684-60246-1172-00B95EFD SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00001684-60246-1309-00B952B1 RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00004788-61256-36-00412722 Sleep@KERNEL32.DLL at 00000000-00004788-61256-147-00409311 WaitForSingleObject@KERNEL32.DLL at 00000000-00004788-61256-154-004098F7 WaitForSingleObject@KERNEL32.DLL at 00000000-00004788-61256-156-00409A1F Sleep@KERNEL32.DLL at 00000000-00004788-61256-178-0040E0C3 WaitForSingleObject@KERNEL32.DLL at 00000000-00004788-61256-219-0040548C WaitForSingleObject@KERNEL32.DLL at 00000000-00004788-61256-228-004053E4 WaitForSingleObject@KERNEL32.DLL at 00000000-00004788-61256-229-004053C1 Sleep@KERNEL32.DLL at 00000000-00004788-61256-233-004056D843:T511,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "RegDisablePredefinedCacheEx" (Indicator: "RegDisablePredefinedCache"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "RegDisablePredefinedCacheEx" (Indicator: "RegDisablePredefinedCache"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "RegDisablePredefinedCacheEx" (Indicator: "RegDisablePredefinedCache"; Source: "00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")44:T607,LoadLibraryA@KERNEL32.DLL at 00000000-00003944-50391-33-00D72F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00003944-50391-41-00D76495 LoadLibraryA@KERNEL32.DLL at 00000000-00003944-50391-42-00D7202A LoadLibraryA@KERNEL32.DLL at 00000000-00003944-50391-73-00D717EE LoadLibraryA@KERNEL32.DLL at 00000000-00003944-50391-112-00D74224 LoadLibraryA@KERNEL32.DLL at 00000000-00002292-50882-33-00052F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00002292-50882-41-00056495 LoadLibraryA@KERNEL32.DLL at 00000000-00002292-50882-42-0005202A LoadLibraryA@KERNEL32.DLL at 00000000-00002292-50882-73-000517EE LoadLibraryA@KERNEL32.DLL at 00000000-00002292-50882-112-00054224 LoadLibraryA@KERNEL32.DLL at 00000000-00004044-51569-33-00B42F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00004044-51569-41-00B46495 LoadLibraryA@KERNEL32.DLL at 00000000-00004044-51569-42-00B4202A LoadLibraryA@KERNEL32.DLL at 00000000-00004044-51569-73-00B417EE LoadLibraryA@KERNEL32.DLL at 00000000-00004044-51569-112-00B44224 LoadLibraryExW@KERNEL32.DLL at 00000000-00004512-53123-863-00278AE7 LoadLibraryExW@KERNEL32.DLL at 00000000-00002448-54058-1717-00C18AE7 LoadLibraryExW@KERNEL32.DLL at 00000000-00001684-60246-1398-00B98AE7 LoadLibraryW@KERNEL32.DLL at 00000000-00004788-61256-148-00409355 LoadLibraryW@KERNEL32.DLL at 00000000-00004788-61256-178-0040E0C3 LoadLibraryW@KERNEL32.DLL at 00000000-00004788-61256-246-0040AEBA LoadLibraryW@KERNEL32.DLL at 00000000-00004788-61256-250-0040ADD6 LoadLibraryExW@KERNEL32.DLL at 00000000-00004788-61256-262-00401BA045:Tb4a,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "LockResource" (Indicator: "LockResource"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")46:T535,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")47:T1243,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78 "DSystem\CurrentControlSet\Control\Session Manager" in Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78 "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78 "System\CurrentControlSet\Control\Session Manager" in Source: 49794-17-0040256D "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000512.00000001.118643.00B12000.00000020.mdmp "Machine\System\CurrentControlSet\Control\Nls\Language Groups" in Source: 00000000-00000512.00000000.118633.00269000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00001644.00000000.118622.001F0000.00000004.mdmp 00000000-00001644.00000001.118983.001F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001644.00000001.118983.00341000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001684.00000000.119641.003B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002292.00000000.118544.00051000.00000020.mdmp "Software\Microsoft\Windows" in Source: 00000000-00002292.00000000.118544.001E0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00002292.00000001.119653.001E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002448.00000000.119312.003A0000.00000004.mdmp "Software\Microsoft\Windows" in Source: 00000000-00003944.00000000.118460.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003944.00000000.118460.00D71000.00000020.mdmp48:T8e9,Process 1dM49pQ2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process AppLaunch.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_4712" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1268_IE_EarlyTabStart_0x1314_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1268_ConnHashTable<4712>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1268_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1268_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1268_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3176" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_c68_IE_EarlyTabStart_0xeb8_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_c68_ConnHashTable<3176>_HashTable_Mutex"49:T9d6,"1dM49pQ2.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1dM49pQ2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1dM49pQ2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1dM49pQ2.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1dM49pQ2.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1dM49pQ2.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1dM49pQ2.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]4a:T5aa,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Ll8cp20.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "UU5HX65.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4wu689py.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "3pt32Vf.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "bk3UW74.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2Zc0213.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1dM49pQ2.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE4b:T742,Found string "https://accounts.google.com/v3/signin/identifier?checkConnection=youtube:368checkedDomains=youtubeBcontinue=" (Indicator: "youtube"; File: "screen_3.png") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "7ED2.bat") file/memory contains long string with (Indicator: "youtube"; File: "_C10DE0E5-9542-11F1-9253-00505691F240_.dat") file/memory contains long string with (Indicator: "youtube"; File: "~DF2F1B351AC1A4002D.TMP") Found string "0a3NCP4yhurehJU0v..Bqeqm4..AAA.0.0.Bqeqm4.AWcwpwe-qbCfr_f49TdUGUSE6j8facebook.com/9217269186969631289349391210754031271248uKl6amWyQxi5nqgOvSiIlYRsfacebook.com/9217423632384031351710391273154131271248" (Indicator: "facebook.com"; File: "N3OO30Y7.txt") Found string "0a3NCP4yhurehJU0v..Bqeqm4..AAA.0.0.Bqeqm4.AWcwpwe-qbCfr_f49TdUGUSE6j8facebook.com/9217269186969631289349391210754031271248" (Indicator: "facebook.com"; File: "IZE9CZUW.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "61C6L624.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL")4c:T1516,"Machine\System\CurrentControlSet\Control\Nls\Language Groups" in Source: 00000000-00000512.00000000.118633.00269000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00000512.00000000.118633.01FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00001644.00000000.118622.001F0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00001644.00000001.118983.001F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001644.00000001.118983.00341000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001684.00000000.119641.003B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002292.00000000.118544.00051000.00000020.mdmp "Software\Microsoft\Windows " in Source: 00000000-00002292.00000000.118544.001E0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00002292.00000001.119653.001E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002448.00000000.119312.003A0000.00000004.mdmp "Software\Microsoft\Windows " in Source: 00000000-00003944.00000000.118460.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003944.00000000.118460.00D71000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004044.00000000.118584.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004044.00000000.118584.00B41000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004512.00000000.118977.005D0000.00000004.mdmp4d:T1862,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Tue 11 Aug 2026 04:33:16 GMT Via: ens-cache24.l2us5[0 0 200-0 H] ens-cache25.l2us5[1 0] ens-cache33.us34[0 0 200-0 H] ens-cache30.us34[1 0] Age: 939 Ali-Swift-Global-Savetime: 1786422796 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Tue 11 Aug 2026 04:33:19 GMT X-Swift-CacheTime: 3597 Timing-Allow-Origin: * EagleId: a3b53cb217864237358097799e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 11 Aug 2026 02:22:11 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 8807 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 26939 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue 11 Aug 2026 04:39:35 GMT Expires: Tue 11 Aug 2026 05:29:35 GMT Cache-Control: public max-age=3000 Last-Modified: Tue 11 Aug 2026 03:35:49 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 563 with response body ==>30C282693730C282681F020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue 11 Aug 2026 03:59:25 GMT Expires: Tue 11 Aug 2026 04:49:25 GMT Cache-Control: public max-age=3000 Age: 2973 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 21536 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue 11 Aug 2026 04:02:13 GMT Expires: Tue 11 Aug 2026 04:52:13 GMT Cache-Control: public max-age=3000 Age: 2807 Last-Modified: Tue 11 Aug 2026 00:09:16 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282541C30C2825304020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520....... "GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Tue 11 Aug 2026 04:49:25 GMT Expires: Tue 11 Aug 2026 05:39:25 GMT Age: 5 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue, 11 Aug 2026 03:35:49 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Tue 11 Aug 2026 04:39:35 GMT Expires: Tue 11 Aug 2026 05:29:35 GMT Last-Modified: Tue 11 Aug 2026 03:35:49 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 595 with no response body "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue, 11 Aug 2026 00:09:16 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Tue 11 Aug 2026 04:02:13 GMT Expires: Tue 11 Aug 2026 04:52:13 GMT Age: 2837 Last-Modified: Tue 11 Aug 2026 00:09:16 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body4e:T2381,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b880000 "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75320000 "Ll8cp20.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a1a0000 "Ll8cp20.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a170000 "Ll8cp20.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75320000 "UU5HX65.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c1e0000 "UU5HX65.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75320000 "1dM49pQ2.exe" loaded module "MSCOREE.DLL" at base 6bb30000 "1dM49pQ2.exe" loaded module "PSAPI.DLL" at base 77700000 "1dM49pQ2.exe" loaded module "RPCRT4.DLL" at base 77710000 "1dM49pQ2.exe" loaded module "KERNEL32.DLL" at base 77180000 "1dM49pQ2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63150000 "1dM49pQ2.exe" loaded module "OLE32.DLL" at base 75ec0000 "1dM49pQ2.exe" loaded module "CRYPTBASE.DLL" at base 75370000 "1dM49pQ2.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6da00000 "1dM49pQ2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b900000 "1dM49pQ2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 626f0000 "1dM49pQ2.exe" loaded module "ADVAPI32.DLL" at base 76020000 "1dM49pQ2.exe" loaded module "SSPICLI.DLL" at base 75300000 "1dM49pQ2.exe" loaded module "ADVAPI32" at base 76020000 "1dM49pQ2.exe" loaded module "NTDLL.DLL" at base 77570000 "1dM49pQ2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6c1c0000 "1dM49pQ2.exe" loaded module "OLEAUT32.DLL" at base 76fb0000 "2Zc0213.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75320000 "3pt32Vf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75320000 "4wu689py.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75320000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a1a0000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6bb30000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77700000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 77710000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 77180000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 629a0000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 75ec0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 75370000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f20000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cd00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a490000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61f40000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69210000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 610d0000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76020000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73f20000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76e10000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 608b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a090000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 64590000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6ba70000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77570000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 76110000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 776e0000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75480000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74f90000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74e80000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c10000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 776c0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71cd0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 759f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 60490000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5f850000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e460000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69660000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 77260000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 690d0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 755f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 67d00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6a210000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74910000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5e180000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5de70000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6c1c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 69b70000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 69b20000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 760d0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74e40000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 749a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74e30000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5b450000 "5yy8rn9.exe" loaded module "KERNEL32.DLL" at base 77180000 "5yy8rn9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75320000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 76020000 "cmd.exe" loaded module "SHELL32.DLL" at base 76110000 "cmd.exe" loaded module "OLE32.DLL" at base 75ec0000 "cmd.exe" loaded module "CRYPTBASE.DLL" at base 75370000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f20000 "cmd.exe" loaded module "PROPSYS.DLL" at base 74010000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77180000 "cmd.exe" loaded module "COMCTL32.DLL" at base 74310000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 76fb0000 "cmd.exe" loaded module "APPHELP.DLL" at base 75320000 "cmd.exe" loaded module "CLBCATQ.DLL" at base 75bf0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a7c0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 755e0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 755d0000 "cmd.exe" loaded module "URLMON.DLL" at base 75aa0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 71ee0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74010000 "cmd.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 711a0000 "cmd.exe" loaded module "IERTUTIL.DLL" at base 75c80000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76110000 "cmd.exe" loaded module "USER32.DLL" at base 76e10000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77180000 "cmd.exe" loaded module "SETUPAPI.DLL" at base 757e0000 "cmd.exe" loaded module "RPCRT4.DLL" at base 77710000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 753200004f:Te37,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" was detected as "Microsoft Cabinet" and name: "sfx" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" was detected as "Microsoft Visual C/C++" and name: "Compiler" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" was detected as "Microsoft Cabinet File" and name: "Archive" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" was detected as "Microsoft Linker" and name: "Linker" "Ll8cp20.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Ll8cp20.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Ll8cp20.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Ll8cp20.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Ll8cp20.exe" was detected as "Microsoft Linker" and name: "Linker" "UU5HX65.exe" was detected as "Microsoft Cabinet" and name: "sfx" "UU5HX65.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "UU5HX65.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "UU5HX65.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "UU5HX65.exe" was detected as "Microsoft Linker" and name: "Linker" "4wu689py.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4wu689py.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4wu689py.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4wu689py.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4wu689py.exe" was detected as "Microsoft Linker" and name: "Linker" "3pt32Vf.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3pt32Vf.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3pt32Vf.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3pt32Vf.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3pt32Vf.exe" was detected as "Microsoft Linker" and name: "Linker" "bk3UW74.exe" was detected as "Microsoft Cabinet" and name: "sfx" "bk3UW74.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "bk3UW74.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "bk3UW74.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "bk3UW74.exe" was detected as "Microsoft Linker" and name: "Linker" "2Zc0213.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Zc0213.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Zc0213.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Zc0213.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Zc0213.exe" was detected as "Microsoft Linker" and name: "Linker" "5yy8rn9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5yy8rn9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5yy8rn9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5yy8rn9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5yy8rn9.exe" was detected as "Microsoft Linker" and name: "Linker" "1dM49pQ2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1dM49pQ2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1dM49pQ2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1dM49pQ2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1dM49pQ2.exe" was detected as "Microsoft Linker" and name: "Linker"50:T164d,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Ll8cp20.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "UU5HX65.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4wu689py.exe" file has an entrypoint instructions - "call 0x406944,jmp 0x406106,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 0xf,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 7,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x4062f2,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc]," "3pt32Vf.exe" file has an entrypoint instructions - "call 0x406944,jmp 0x406106,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 0xf,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 7,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x4062f2,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc]," "bk3UW74.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "2Zc0213.exe" file has an entrypoint instructions - "call 0x406944,jmp 0x406106,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 0xf,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 7,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x406a60,int3 ,int3 ,int3 ,int3 ,push ebx,push esi,mov eax, dword ptr [esp + 0x18],or eax, eax,jne 0x4062f2,mov ecx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],xor edx, edx,div ecx,mov ebx, eax,mov eax, dword ptr [esp + 0xc]," "5yy8rn9.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "1dM49pQ2.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"51:T881,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Ll8cp20.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Ll8cp20.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "UU5HX65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "UU5HX65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "bk3UW74.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "bk3UW74.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1dM49pQ2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1dM49pQ2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1dM49pQ2.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "1dM49pQ2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2Zc0213.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Zc0213.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3pt32Vf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3pt32Vf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4wu689py.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4wu689py.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5yy8rn9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5yy8rn9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")52:T1061,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00004044.00000FCC.643627.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003944-00000C2B-853846919] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003944-00000BC1-853988517] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002292-00000BC1-854800780] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004044-00000BC1-855445672] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00001644-00000BC1-855616929] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00000512-00000C2B-856746040] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000512-00000C2B-857035747] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00000512-00000C2B-857444939] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00000512-00000C2B-857591980] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00000512-00000C2B-858231947] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000512-00000C2B-858388516] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00000512-00000C2B-859320769] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00000512-00000C2B-859974758] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004404-00000C2B-872962676] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00004404-00000C2B-873257336] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00004404-00000C2B-873303396] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004404-00000C2B-873389309] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004404-00000C2B-873461327] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004404-00000C2B-873481417] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004404-00000C2B-873512631] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004404-00000C2B-873635212] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00004404-00000C2B-873849903] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00004404-00000C2B-873907820] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00004404-00000C2B-874206467]53:T4b2,Spawned process "Ll8cp20.exe" (UID: 00000000-00002292) Spawned process "UU5HX65.exe" (UID: 00000000-00004044) Spawned process "bk3UW74.exe" (UID: 00000000-00001644) Spawned process "1dM49pQ2.exe" (UID: 00000000-00000512) Spawned process "2Zc0213.exe" (UID: 00000000-00004512) Spawned process "AppLaunch.exe" (UID: 00000000-00002956) Spawned process "3pt32Vf.exe" (UID: 00000000-00002448) Spawned process "AppLaunch.exe" (UID: 00000000-00002936) Spawned process "4wu689py.exe" (UID: 00000000-00001684) Spawned process "AppLaunch.exe" (UID: 00000000-00004404) Spawned process "5yy8rn9.exe" (UID: 00000000-00004788) Spawned process "cmd.exe" with commandline ""%WINDIR%\\system32\\cmd" /c "%TEMP%\\7EC0.tmp\\7ED1.tmp\\7ED2.b ..." (UID: 00000000-00003144), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00004712), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003176), Spawned process "iexplore.exe" with commandline "SCODEF:4712 CREDAT:275457 /prefetch:2" (UID: 00000000-00004832), Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:275457 /prefetch:2" (UID: 00000000-00002516)54:T4b2,Spawned process "Ll8cp20.exe" (UID: 00000000-00002292) Spawned process "UU5HX65.exe" (UID: 00000000-00004044) Spawned process "bk3UW74.exe" (UID: 00000000-00001644) Spawned process "1dM49pQ2.exe" (UID: 00000000-00000512) Spawned process "2Zc0213.exe" (UID: 00000000-00004512) Spawned process "AppLaunch.exe" (UID: 00000000-00002956) Spawned process "3pt32Vf.exe" (UID: 00000000-00002448) Spawned process "AppLaunch.exe" (UID: 00000000-00002936) Spawned process "4wu689py.exe" (UID: 00000000-00001684) Spawned process "AppLaunch.exe" (UID: 00000000-00004404) Spawned process "5yy8rn9.exe" (UID: 00000000-00004788) Spawned process "cmd.exe" with commandline ""%WINDIR%\\system32\\cmd" /c "%TEMP%\\7EC0.tmp\\7ED1.tmp\\7ED2.b ..." (UID: 00000000-00003144), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00004712), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003176), Spawned process "iexplore.exe" with commandline "SCODEF:4712 CREDAT:275457 /prefetch:2" (UID: 00000000-00004832), Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:275457 /prefetch:2" (UID: 00000000-00002516)55:T77f,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: BA:C6:99:E9:64:02:FF:95:66:20:65:AE:B5:5D:85:CC:E3:0A:D9:A2; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: A9:3F:6E:0B:AD:3D:D0:80:52:15:1D:D5:E8:C7:78:BA:77:A7:82:4B; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 7F:BD:C4:A9:13:6A:32:2C:09:53:6F:2F:97:E8:F1:5A:19:20:23:E7; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: AE:5F:C0:24:68:39:D9:F5:CF:2F:CF:44:C5:8A:5E:FC:9E:C4:C6:D5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 3D:94:C9:F9:12:2C:6A:03:5A:6F:30:B6:B9:7C:B5:42:84:D4:04:1A; see report for more information)56:T612,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")57:T1675,"Ll8cp20.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\Ll8cp20.exe]- [targetUID: 00000000-00002292] "UU5HX65.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\UU5HX65.exe]- [targetUID: 00000000-00002292] "4wu689py.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4wu689py.exe]- [targetUID: 00000000-00002292] "3pt32Vf.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\3pt32Vf.exe]- [targetUID: 00000000-00002448] "bk3UW74.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\bk3UW74.exe]- [targetUID: 00000000-00001644] "2Zc0213.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2Zc0213.exe]- [targetUID: 00000000-00001644] "5yy8rn9.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5yy8rn9.exe]- [targetUID: 00000000-00004788] "1dM49pQ2.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP003.TMP\1dM49pQ2.exe]- [targetUID: 00000000-00001644] "7ED2.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\7EC0.tmp\7ED1.tmp\7ED2.bat]- [targetUID: 00000000-00004788] "agrw5GZkrkaaxgIECUhI-2xgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkvx2I9b7Pb8K_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "identifier_2_.htm" has type "Unknown"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document ASCII text with very long lines (65536) with no line terminators"- [targetUID: N/A] "OW54LMWH.htm" has type "HTML document ASCII text with very long lines (57134) with CRLF line terminators"- [targetUID: N/A] "imagestore.dat" has type "data"- [targetUID: N/A] "_C10DE0E5-9542-11F1-9253-00505691F240_.dat" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "data"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "data"- [targetUID: N/A] "~DF2F1B351AC1A4002D.TMP" has type "data"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "data"- [targetUID: N/A] "~DF30FC117A2ECCB7EC.TMP" has type "data"- [targetUID: N/A] "~DF29B920CD264F9297.TMP" has type "data"- [targetUID: N/A] "~DF21F45BDD51DF5420.TMP" has type "data"- [targetUID: N/A] "~DFEE318110E1A0AE17.TMP" has type "data"- [targetUID: N/A] "_31EDB404-9542-11F1-9253-00505691F240_.dat" has type "Unknown"- [targetUID: N/A] "RecoveryStore._C10DE0E3-9542-11F1-9253-00505691F240_.dat" has type "Unknown"- [targetUID: N/A] "RecoveryStore._31EDB402-9542-11F1-9253-00505691F240_.dat" has type "Unknown"- [targetUID: N/A] "favicon_1_.ico" has type "Unknown"- [targetUID: N/A] "_4CAF209E-954A-11F1-9253-00505691F240_.dat" has type "Unknown"- [targetUID: N/A] "OIjsl4A27YL_1_.webp" has type "Unknown"- [targetUID: N/A] "googlelogo_color_74x24dp_1_.png" has type "Unknown"- [targetUID: N/A] "8A7891822FCFF127E4EADADE9757112B" has type "data"- [targetUID: N/A] "5341892C458FBD70D290A3F6C0EA9EC1_7EE14905ABAACC5D314503A447F644D0" has type "data"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "data"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "data"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "data"- [targetUID: N/A] "ZCJK30TX.txt" has type "ASCII text with very long lines (480)"- [targetUID: N/A] "5CO3A2UD.txt" has type "ASCII text with very long lines (480)"- [targetUID: N/A] "4PJKZ8EJ.txt" has type "ASCII text with very long lines (480)"- [targetUID: N/A] "2DTTA43P.txt" has type "ASCII text with very long lines (480)"- [targetUID: N/A] "1732W1VL.txt" has type "ASCII text"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "data"- [targetUID: N/A] "WQ36IWQC.txt" has type "ASCII text"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "data"- [targetUID: N/A] "RHSYCX72.txt" has type "ASCII text"- [targetUID: N/A] "ZYD5XGX2.txt" has type "ASCII text"- [targetUID: N/A] "9DFE38F0CF4E54F251E86E53D05E8885" has type "data"- [targetUID: N/A] "M4NKM3IW.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "I8ORM28J.txt" has type "ASCII text"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "N3OO30Y7.txt" has type "ASCII text"- [targetUID: N/A] "5Z5HQDH9.txt" has type "ASCII text"- [targetUID: N/A] "II9RS3LW.txt" has type "ASCII text"- [targetUID: N/A] "IZE9CZUW.txt" has type "ASCII text"- [targetUID: N/A] "8EX2Q0GU.txt" has type "ASCII text"- [targetUID: N/A] "18Z14R7I.txt" has type "ASCII text"- [targetUID: N/A] "P10I1GZZ.txt" has type "ASCII text"- [targetUID: N/A] "61C6L624.txt" has type "ASCII text"- [targetUID: N/A] "ERU5R4PO.txt" has type "ASCII text"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "suggestions_1_.en-US" has type "Unknown"- [targetUID: N/A] "T6FBA9HG.txt" has type "ASCII text"- [targetUID: N/A]58:Tb94,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")59:T43a,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3944) "Ll8cp20.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2292) "Ll8cp20.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2292) "UU5HX65.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 4044) "UU5HX65.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 4044) "bk3UW74.exe" queries basic process information of the "C:\Windows\Temp\VxOle32.dll" (UID: 1644) "bk3UW74.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 1644) "5yy8rn9.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp\7EC0.tmp\7ED1.tmp\7ED2.bat" (UID: 4788)5a:T10d8,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "0B3A82C1A567E16E191A934DF57AB14DB3C6B8CC3836E2A52B8B5AE12D005D78"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")5b:T5d9,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\ll8cp20.exe" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\5yy8rn9.exe" "Ll8cp20.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\uu5hx65.exe" "Ll8cp20.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\4wu689py.exe" "UU5HX65.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\bk3uw74.exe" "UU5HX65.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\3pt32vf.exe" "bk3UW74.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\1dm49pq2.exe" "bk3UW74.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\2zc0213.exe" "1dM49pQ2.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1dM49pQ2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1dM49pQ2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "1dM49pQ2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "2Zc0213.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "3pt32Vf.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe"5c:Tc9a,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe.Local\" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Cabinet.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\VERSION.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\SspiCli.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\WINSPOOL.DRV" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\MPR.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\MPR.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\UxTheme.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\WINMM.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\samcli.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\samcli.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\MSACM32.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"5d:Td25,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\Cabinet.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\VERSION.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\SspiCli.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\MPR.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\UxTheme.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\WINMM.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\samcli.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\MSACM32.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\sfc.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\sfc_os.DLL" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\dwmapi.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ll8cp20.exe" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5yy8rn9.exe" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\FLTLIB.DLL" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\MSVCP140.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\ucrtbase.DLL" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"5e:T87a,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe.Local\" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe.Config" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\0B3A82C1A567E16E191A934DF57AB14DB3C6B8CC3836E2A52B8B5AE12D005D78.EXE.LOCAL" "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" trying to access non-existent file "C:\0B3A82C1A567E16E191A934DF57AB14DB3C6B8CC3836E2A52B8B5AE12D005D78.EXE.CONFIG" "Ll8cp20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ll8cp20.exe.Local\" "Ll8cp20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Ll8cp20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ll8cp20.exe.Config" "Ll8cp20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Ll8cp20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\LL8CP20.EXE.LOCAL" "Ll8cp20.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\LL8CP20.EXE.CONFIG" "UU5HX65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\UU5HX65.exe.Local\" "UU5HX65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "UU5HX65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\UU5HX65.exe.Config" "UU5HX65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"5f:T26e2,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/yp/l/0,cross/agrw5GZkrkaaxgIECUhI-2xgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkvx2I9b7Pb8K.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yp/r/OIjsl4A27YL.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yf/r/ipwqPKyH2FY.ttf HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:vA3CclE5cFjIgozw8-qtJzABDEIkmg:5IrZUbmDfMUIzmL7Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&dsh=S1343172368:1786423738583884 HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:vA3CclE5cFjIgozw8-qtJzABDEIkmg:5IrZUbmDfMUIzmL7Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S1343172368%3A1786423738583884&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&ifkv=Ac50bxtWQfkA_DZlb6ZaxoEKBCkAXmYUOnIVdNh5gXQAEzFRQTL7rX2LugWYYZvK87BgYxcFPFjKDg HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:vA3CclE5cFjIgozw8-qtJzABDEIkmg:5IrZUbmDfMUIzmL7Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:vA3CclE5cFjIgozw8-qtJzABDEIkmg:5IrZUbmDfMUIzmL7"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:vA3CclE5cFjIgozw8-qtJzABDEIkmg:5IrZUbmDfMUIzmL7"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?continue=https://accounts.google.com/&dsh=S1343172368:1786423738583884&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&ifkv=Ac50bxtWQfkA_DZlb6ZaxoEKBCkAXmYUOnIVdNh5gXQAEzFRQTL7rX2LugWYYZvK87BgYxcFPFjKDg HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 262DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:vA3CclE5cFjIgozw8-qtJzABDEIkmg:5IrZUbmDfMUIzmL7identifier=&hiddenPassword=&usi=S1343172368%3A1786423738583884&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A119972&checkedDomains=youtube&action=1&at=ALX_P8sAP0uWaRQgqMFsorlJphaR%3A1786423738825"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:119972&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S1343172368:1786423738583884&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&ifkv=Ac50bxtWQfkA_DZlb6ZaxoEKBCkAXmYUOnIVdNh5gXQAEzFRQTL7rX2LugWYYZvK87BgYxcFPFjKDg&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 258DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:vA3CclE5cFjIgozw8-qtJzABDEIkmg:5IrZUbmDfMUIzmL7"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:36&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S1343172368:1786423738583884&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&ifkv=Ac50bxtWQfkA_DZlb6ZaxoEKBCkAXmYUOnIVdNh5gXQAEzFRQTL7rX2LugWYYZvK87BgYxcFPFjKDg&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 258DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:vA3CclE5cFjIgozw8-qtJzABDEIkmg:5IrZUbmDfMUIzmL7"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-617842373×tamp=1786426438024 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1556965028×tamp=1786432328135 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1105818230×tamp=1786432427533 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=160632117×tamp=1786432581957 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com"; in File: "SSL")60:T14a76,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "��x 2�]+�~��F��B��T�hGG��ط�%�(��,e�ƣL��A��Z�d0�C�0�L$�24�4��Q��1=�A��ЂzYS�!�u��J�wY*��ّŰ��wV��"KJ�׎B�L�5��%��ǋ�Z��&J��۹5pTQTfr�a��]�Q�-<�J�(D�1�±��J\4"��E��v4��O��b(��<��E�,�j��Ź��5�<�>�b�3\�DS�]8��h"��,�Ґ,%�g/\D�k4a�@�ֶ�$)��MqZ8��R�vE%K-�ǃsi�^�E�x��a#SX�AW�`h�G��ƝEdo��u]?��)FC&��./V��{ꉩ�4��a�g�b�I��*H*��ڪ��Y�럈�2�Y%d�OF�>�@�f�/�hA��A�� d/g#U��O�\=/�!<�}�9n�?�c��K'Q��#�H�(>��H�$��k;��G˨"�t��J�-^�s��'��ϭ��x�OZ��J��?ɢ�G�(��Ӯ�ן[��ۉ�Ad�]�ܚ�`��$��Ml%�O��W8Cb��.�TrH��1��4��zRW)�ף��t�߲�U�j��ҕ��x��^Jd /��>� ʺ-�II��V�:��ʨP�]VIT�H�*��;7�t��u<��'vN�˵U/��WY�AuS��P~�VzᲐz�7J*R��Q�A-Qz+��-�2��$viͳ�Xr0�;�sU��(�z�\�r�UC�WhĒ��U��Q�-��d��H��=�!K�^�<�,ҥ�*�@.�>LA��ҢJYBi)JM��%8NЍQ��ŽJ��MZ��_��Uh��_Y��dHZF]�Dc@Zp�T��`W.{8��|T*#+;:t\1��H)#0�v�V2c�DR��ɧ��h<6�v ��QYB=��p�Q`0�8��%u��2f��n�F�", "t�I��`)t(z�<��I�+�$�p��db7�Daz*��HZ�l��18^ƟēW/�WY��X��IHoh(X��mh�\{]��g�v1`��N�d�{�f[v೹F��f6�+�UXj��OH�x�V?�͐/I��3P�,��8��r��E�'�}�S�>�&�k��e��Uw�7�/�X�Z�"þ�mەԿ�~4��q�6V� ��qc0pA/�� ;ۤ�)pl�Z��2�0�<�A_�UC|+^�}`��#�� R�Og��{��Q�aDOntx��3��;�lTH��d��A��#��u718��-$��DUݰܺ/�ɡ�J�%��Bk�f��\��H0i�Y��0*b��8H�F��RQw ��0tV��J8E�"�B�2�P�`p+S� <٣��m_C�aU�Z��z�c9N�n�%绒��n��LT�u�\6b�� 7V��:��B�B1��p�%�:��E�#�"�Po��0RP��Sq�]*q7V��\4��k��(S�" "fe0�YnZ��r�Qz�(N�od�q��h2�k:'>��חQ�1�b�@f�虒qY��)��4Q2<�Cj�`K��㉀$*g��1rL#g�J��Q`�v�z�_�9��*8��B�e�(�Ԛ�v��u�5/�P�yZw��M|߆�;��("p�h�D�5:�Y4gp�y8�6P�s0l>��b��S/��\-��;�[1��J�Ii��k�xmHc�@%5%�*�E�y��Zq@LKCpX��@��D�<�b�B�Ap��ɶk��L�0ȍс�\Y d!ʗ�o\4~4��%PD��z��tCu��r�](��wH-q��[��GRfc�%6V\�UyE�K�0'�z�߶��r��dT�%�I��r8��2�('T�p�Y3T5il��v��$�Arҩ�f�ɇ00"�ʣ�U�anxa�}�&�+��[þ��(o$I��@ap9r@��VR�kn�d��+��}��l|��`�n=��t��5nҏ��6�0Z�r�`�=<��]n}+��Xa�I��{�t6x`�u�(��Z�Џ��0�ȷ��1-;Z��пt��z�u{�_�l�.#��n=]�.�$�b�Z��P-��;��(@��z�Q��&�/I=��u}��P�Z�հ4vS;��W�A^wB�|ҩ��Up��N}�Il��~~и/��t�W�>չ�@8��{R̽�(��a�RƗH��E@f�=�9��d��9l��2�:$J�jf��-I��+F7��`gY�8ʽ�vR^��(�~$�a��V0��O<�8�:mSX��(�]�7O��fm��|��'/�Dqj��'��I"�s�ΰ�'�##8Ԃ�z��M��?�x��#nt��mAX9��Dy�r��b�X�[�|h�M�]��Vƀ1"\v�Ř��ܰZ.��P��]ptW��^b�*�(�*Z��㘈뛾��)� ��sG��f��PY��S|�^Yq�[��ҐD]�Ԯ �--*&��:}{;]�m'<��,Nb�t�ڜ��K�g��.N=;j��斳t��lt�=]��s?��b��NVQ��۴�k�V��86R��g��О{�r��ad��۹��a[az��:��8��̏�^��tﻭ0m�C[پ?��.��8�R�u��U��:��t�e��'"��oԷ��oVVG��rn�$-�ߩ��Jb(qq�%n�r9B��S�8��S�8��8�~z��p�2��.(��TL��Q��n��[��2��+�O�&�+��a�G�n�4;��OTU54��(�0��-{��m��OL�TL+^��Y�־�h��!��IO��@a��Օ.��7`��o~�$��o��WS3u�D��jLfq��`<2I��?��Fc��Hb�:��AU��Iod�Ƙ�D�n��(�B=e�WDEQH�Y˹j�v4��s5��3hH�t�U��Z�D��L��\��h�ޘ�0�ޱ]�/4�B��^`�{8�3�� A��@��s��J�Eڷ�s��wύ:{©&�?��l\;��A��n�N�),�j��`g�e��H�*3�+7��S��T*��a��i�j[7�F#-ka<�lS5%��A��/�f=T��d0�JcS�2�A^��OΕ��+�_�X��Z��TǤwf�ĵ�EU��|<6Ke��Vꢼ��q.��\�󱙍�(u-��A��@XV��h08/5�"��F\H^߲)�KU�c`Ɉ�I�v��+�@��jYW��㎩��ZLi46Ǚ�i�K��I�p�N�mCo��jڀ�a��)�ו��16��iB+��Dh8�DJ�LYM̌:36h416J��(�3ÃFã��撘%tf��hb��Й)�w}?z��c��s81X��`�@/��Wk_�0��%�g", "�T[0��$ h��FJ�/f�Q( ��b]��b'� �0��2{��v��PCdY��,��%Q�~85j�5q��X/uE�FJx��PܸITG�l��2�eM�4�P��֪#�t�9(�9<[$�2��Y:�+GE�N��m�89>犛��"��Ϲ��B��+[�x�<˴��?��n(��Q��co�۱�9��B�A�G#z�J\�cH:�l�A�5��B%�@I��J��"��t�KQ�)�B:De(��R�!��ogwX��SEZ��$\��Sv>�<��X!8�½�1��8�]�HTi�TT��U��˅g�Zx�69�E�@�))_F$��s�"">��C8P"<�^��V��V��h�U�Q�x��,��.t��ի[�c�b��B�I܂��R4^�@o"{"�s�l.�O�uIP:�Z<�P�]<ƋGQ�ln�9�SЅ��-�4ۃ-��`}��G�~�Q��h[��-��P�x�K��Io�w8L\)�C�k��8��*��xhjh��!Q��u�`E�Š3�OXx`,��"u!�1t}��Ԯ�`~��m��Q��+��&�D� �<��]�p��B�{�HT{��+��bAo`��.� dr]}GȂ��s^�eB��˲p��XWzp��HEݿ�C�g��54�X>�gEJh �M0�e��M�|e�[P�'��b��FCeP�5t`�2�·��E��"�M�;�z�!��!��s�Y8~��ԇ�Z��!��87�[F��l|k/UOPE��4?1!�9��)�SY�Y��*'J��#��џ��9��=爷�'�� d��>��E#5�β'�B�L1=̕��9:`Wi�;t�?��Yd��;�Q��tpM/�6F��r�$�J�?��@l��$R�|T�ι��E�_��A��X��Zr��\j.6��(^4)�-�M��Uu��0*{W�<�� Ĭ$�� n�@�u��3��LUj��$�o�Ln�`v&d�pE��Yzӈ��ت`p��plV[a}�f�~��L�R�9HTC%$: �v4^g��(��\��Pf�GsS}dގ��\Ъ��}�4a$�J�Hꁹi.�o�'~J�'�n��_.�!�C�.�x��`��#��~e;]V�\W��0v�[2x��WK�?^R�:��K�p�Ǥ�;X��%gdɓ�F��qҦ9��-��=:��:�x+�&[�C�žz��dU�5��Q�#��{~.v��(Bɒ9��AEI�H5�[�e7_�8�;J��n�x�$3��q�8��`��W�7pP`A��vi|+�~}��>0_�k��Pl]S��qc��;;@V>�T��l��5�J�*s�H��J}�L�J�q1�س9�r͑�fxȭ˾�ȉ�q��b��B3��[2+-�C2��A��x^�uk�ܥ&�?:��e��^��]�.�~�#Xj�}HD��Bx��ԋo��Y_L��/�aӠCkRB�mH��G�Se^'r<�P�p��^~9�b�V�!̽��X}��"��8��l�R#0�+�S��Խ/��êa��r}p��(��x�N��9j�@;I��!x��)��46L��z�o4��y ;E�b*��Q��G��hoh��]�u��2��)޼#̍�d��Q2�uU-�+l��֏�km4�[hGI��#��1R��#�mP�2��mS�2YMv�r��K%��l8)�sI1E^�$��&&@YĞʓG�M��#�k��(�*�"��j�u��r��:_�y�O��e�X`�.��H1��-�;�A')"�wM�՚(��X�R�>4�:��.�s��(��±x�>��'�8��A��i�7��E{�n��~Ei�o�" "fe0uD�J�̾0��p9�.��K�r�h}�_.DW�aʥpG.�#�.cǥq��q�#��.cĥqƗ�֣�1��7��M�|�r��o�:��ᶤ��{��8��dB%�PF]&ԨL�t0��VT��ɼoY��7��c��0/��M|��t��h��"6��U4�ʁ�-y��Gwe�h�\%9{©&�?��q��^��1�y!2��X-��ք��C~ޣ!L�fH�K��k��@�ʐzY|��hLUF0�p}D�o�.a��A�F�ʐڲ�ɣ��R�/̝\��1��a�H�(\2]F��Ӟ��x�'�NG�x��-}a쁒?.�h8�J�LMM��:��i4��K�l��d�/�3#�F#��撘%tf�hb�ЙY��RCNHd�Apn��P�z)�f��dv�V�M��o��%ۆ&�GSHY�4�GS�H�4�]�b��"_��ԲW��|`[��4�U�$��]�V>��K*��?�Ck)��s�X��13Z��ܲF�Ee�1��C��b0�!��8(��g�SQe�v�N��C�E^��"��!�S��Y��wj��ŉ�4��4�?��aw�n�3Z��y��O�AWV�*4�'��E�u��]�9Y��?�4U��*8��J�O��l��c�|��U$�j�ـa��g��*�� ?xOkfJ�ʮt�߷�T\^G�t=�.��u��jxf��Q�� q�(xO3A��ư˔�3d$�Ce�d��X)h��H��{��U�S)|�W�D5ԑ�/��2VE��|R�ך��Z�bN��Φ�ż�G˨"�t}A��E�u�#�u@3\ET\��x勜�%:hI��ъ��Œ�1-|"rp�%�˿z��/,�}^2,%}�R��ݛ�Waq�$ �9]b��n��?4�|��fETN!-z�)pr�OHOE$J�AZ2UCL��ܡ��(��-[}6��z닧��sy��Ϊ��=m$«15l�َ��"��SZc��ځE)�eu�P�g%:��¾|..GY�E��"��"��UY�,YL��2uf��Ԃ��g��z��E��Ɵ��U3v{(��t�'��/>��g�~/�=*^ϴ�:�'��|��'��>[��h��M%0hD�qR!T�^��d��ǩ8��r��C��A�Z��l38g�W��!\3s��%S�dt�x�GeX|��Z:�{�]��Q��Q0S\aT�yE�0%3?H��g_�&x�4#{Fd^:��O��@:��f�\'��Ġ��B��K2��IO��k��", "\8Wq��D�B�wG=�>��I,��i=�Z{~a�!��s�Qm�(�}�&�uI��k��Gv��,��w�π:C�0�z1�7�s��MB�H�Y;p$��PT(�|:�-�� ǭ�2��e�ϼ�%�{|ǲ�v��x�`��ͮ܅GBA��3�~��ݪ��6T��ꪡ��od�A�)gĪ��H�YB��{MtM��d�Kz/i�˼��&�`�)��?��ސ�^W��"�|��[)��a��ۊ*�EZ{��!��'�b=J=ARt �G��Rd*�W:�*�Q�{��מ��=��k1��Yy!Vx�)&��!�^��=��&�t��;��L@��e��w�3��ݐB�@3A���=��p,�M�:��^�cp5Ż#�*��а݃��E�'��Y$�P��u]�A�}OP@�<��{8;t5t�d�d�(F%�=��r��^7ISHCg��c�%n�� m��۾�o��s}n{�� v\@7��ఋ��v�9Fm�g��۾�K�0e��>{��{��+vÑˑb# H�b"I0#[�GJ��g��|��U��e��Uz#��a��y~z.��8� ��>�2�5\�P�"( �� Y��S��=� �t�;�W��@�O�U��sl��V�U8�=�S�zrO��s�(�no0��J��b�a=��%�G'�y��}vi��o��n�܃�=��s��>K��O��P�|�}5�<4R^�jzN�T]z\8G�$m��K�\��Ϧ7:��ި3��C��>;t��8�,��?��ϖ�UbȒY�\7rB�ن~�3��LUj��!ђ�܃��3!�+�<�C0[��$bR�M�ñXUlvNzl��yݾʌ��:|b��ލ`��j��y2��R,�]�f��~�}uF+D�I��c�Α�f�zw9oC��c��X�x�qhl疱%��<$SZ,��g��1��B�;��[�!��YL��!��߾�Z��TD��7ϫB��!�}v�B��P��@��;��^;u��^�I��<�L�&�C"d�I�4�!��f� �C�rw@��I�8�� !��1ɶ ��1��i$��X.'Sf��F�d�=֣d��ZW�$�&��j!Rk��}��:ِU��8J՟ڕ��6[-�+�\�;�Gɐ�TeY��$i�Ð��Æ�B麄+@��tDK�PVM]Qt^��\��@��)��!#�&P�?��.��h~���k�ߞ��*��;>��ߞx��y"�x�{��ӯ_�R�-�k�u�p݃5��QI3��}�[�u�p��BX�ri��y��H��b�i��)t�u��w6_��c�ud��x��oR�r�+V�||�u��=�z��˾�뾾��ǆ��o��P�8Yhц뾘�r��N��o���fǡ�}�u�C�d��}�u�p�gT��PT(�|:�-m��{�߰��C��q4\��4��=�K↽��\ye��u�D�u_�&5\��HI=�E�?�b�m��aw��o��kP$�V�b�A�}�u_�,YY�Ep��K�0ׁs-؈�s��8Хj��p�3��D��}�uOh�o��,��gY{��7\��#�2��l?�D�uO1K�2�('T��xP�M<�pݣ��ắ �ߣeK4\��o��p�7\��}�u�p�7\�$�6�}5�{�u�p�7\�8ن��R��}�`Y�랏1��G�3�r�)��p#?�p��v�Pٮ!?g��B��`�p�W", "eb0�q)��o��y\��}�=��G<��s�%7=š�g1�=L�CRO�!�"�tj�ầDۂ.�}�u�p�7\��ǅst�N҆��U��e�D��=š�g1��aX�u�{��8�pl�G��I6��F`U�q�:�Y��u�J(3�7\��}�9W��n��0��Ԑ�SI6\�u��aubܜ}W#"1p��R��F��>�S�!�d�u_%��s�}�u_'SZ,��g��}�u_��U!�k��o��k�d��/US�uO�_�u�pݗ��p�CO��/��i<��N�v+v�mHV��[��]|h�}�>A�[\L��6]tz��U�6�(w�R��Ϸnh+�ѓ�t��>�n<��GQ�Gh�f%�m-�W��[v%I{K/�ж�(��6�b��mhK��ٯ�$v�mҖ�|h��[�m�;�f��F��~h+��E��o��O�v��I�۷��N�%��l7�s_��4޺B{��_�$��Vh-ݘ�Q��ү�"��k�ݰ�o�?9��؞t�7�u��}�nm�w��²�(��~��H��8�v��ջ��H��ڛ8��ꅶ�uܯ��s��'.�lX Y�9o%��.��7kg!��v��^<��˩xo>��w3g+��_��ɛ?�?z��}��*�k��J�"[��:��]�mx��<|�n�ϊ��;g��gSS��ㅩ��y�x��ξ�'T��O�J�&�z��&�f��p�[\�G.��q�7�/��v�qiˆdw��ϓ��\�?y��݆+�6�y/��6�|gh�m��m8��!��g�o��g��N��6�u];|��I�ޮ��F��D��a��ϓ�4�Dkblo.�6�r�;��7�o��|��{��4��y��o��5�=�;��T��־|~��y��r�`�1��ߜ��=��p]��f��x��.?n��n�L��͞�GR�\޿��V�_��C-x��sO�Φ_vvx��k��e�Nz;�멎xo��O��~�*�~��7{�OR��s񶶿I]P��P&ZRhC��F�'#��f;;�V��D5�ko��ٿ�M�&�f��u�u.�Ԛh�m��A5�e�ѹ0��r�͍|��Φ��g��m��y��O��L�u>��1��G��" ""�m�H�)L��c��M�%;к/��Ӆ��_tZ��ك�m~��~1��#��p�2��e4Â�͔į.gS�X<��=$��os=3;k��7��ȹ��M��w�G6�dg{��Q6__��S�N4g��v�{��9[��W��.Se��f��o��_��?FC�A��_�ܯ��I��o�{�&�Y�-��JS�?�!��h酗Q��=��1�}7n��v_ڋv?��s��'�z3��K��a�_��u2��l:�|1��w��c��0�f��1��]}��ol��_󉹷��T�f��G�1��f�/��ƾ�_��hA��l��`��t��O`��u��"v��l��%ԏ�;��|:��fd@6ȗ��J��67�U^7��`\/f��3��Ȼ��˞w��&��e�ɻ�n��w��n�t=}x�:��1�^��M*��J��,0��I��7��f��P�|��Ihg{��l��ϫ��\>קּ�L<��l*��:�^s�:}�h�f�i�2��o��~�_�p�>�@��J�ma��mǑ�73y%~�v\�Y��Ž��mc+��>��T2�^ow��ϕ��~5��{Ѿ��w��ǭ{��΂�o�u;��[��>n��"�*�w�\�l�E��v7r>9��?�TMD��3��'��[Q��ƕ󢾺x�f~��Egz~��y>��ϓ�݋��z7�\C�0v�L��!l��aΈ�E@��Å��t}�d~��o��]y^[��ҶA��_P�_<�:�,�9h��-6��|��{n.�3��6�$��b��H{7�L��s:Wf�=�.?Z�;q6�|�[z�c5^%��:�=m?�H;'x��^�l`}��j��#�V�-��W�؁��\P�24��Z{�AY߉s�z0�x��l��k��r��Û��LQ��G��k�,n>��S�3�^��|mx��w@�i��)��0E�/��߸`m�Q8^|�.�d��'X��'��}�� j��Z&f�)k��1�a�Y��)hW��s{��5��O��.�&o��E��÷wgr-��O��nh�o��K��xo�C��[QN~�t]��Ž��=t��}v��"7LO��Ns�OC�?��0��K�<Ǎ�bxv�Z�aQ��?�{2�<��v��b��o��S�Ƀ��-��+�t�4�!�A�?��?�u�_�n�D��'t��M�׏�N�o��ʝۉ(�� ƕE0�^��w{��|R��m��h��q��Y��6+Vi�I�gg�G�مj9��>ݬ6g;�l�9��D��3k�j�u��x��o˨��y��h2z��V��אT�,F�ww잌�OwoB�euu�ۓjl��z�޽�WƼ�y޻9�J��"��`�~D�V_��ނ��m�u��_��_��ί��", "5d3�ks�H�.��^�Ğy'`��3�LȒl˖e�(��m� �@��0.��'�wlw��1g�-��YYYy�W��o/��Qt��D��?�c�>=e��ϿknS��xf��?ю�?O�61�Q�1�mc2��n��/��!�N��lX�+��,s��bԾXck��Ԛv�G��d4�UZ�ůj:��n+UG�(�ė�ش�b8HۚM�A�a�G��Olkj��{ҵ�ݣZvclQO� Sj& ��P�^�ٸA��-�d&�n��2��ejLzAfbM��f�32��u��iƤfd��X��>K"�^�Y��SC��hc��cY�ZW]�L�ޝ�ff��w��!�LzW��a�q/��Ƥw'lcZۉN�쇱��f��ӱ]��jv�2��)�hh�b�hh��0��Al;�9�l��ꆙ�O}$/�}0�a�xƓ�噍z��X�񸗬�'�u<��x2�]��t؋��}L?=p(&�`��81��Ĕ��>{Ի�{�KS'�a��ɤ�N��7�th�b�th��'ӡ�(��p��w��i�~MǒQ�3��}:��lؿ_3Cr��`�a_��fԻ>��ջ��p8��'@�KdM��ٻH�pR��N��ect��Q��b��h��q��b�C�}�!1��{j��_K�0��4��i��JP��L��m1�~~@��t�3�0-��9��DJ�YC)��"�o�2��a��:@�`�\��mpl%��cY{,�V{��_t�=��~$��ݍ�~��Iy�~ )��4�_��2�@|��n��7ƣ.׉9�oib0��O�:ǳ�a[�O%�t�I��>��Nz��=�7��@uF��7�N�:a��;��N*�a�,�!7�t��b2��~�1�pcN��-c:;��=��tpf��яo3ct@Cf��ȘYЀY��:Sf�:��9�Q?�hXosh��yԋr�p�/0�S��@��i��V�qό>�bg�7!��P0}b��QJ��Ͼ��9`�u�c��_�p��t�J��\��4c8<��C�w��O�Mc��P?�0��;d��-��7cX��֙�z��sHF��4�~��i��y�%��@��G�iL�u˦9�q^�y�t�4��9��g��t�g��ΐ��c�e@Q,��b��]�ܲ��X��5��V��ty�fp0�y��m�ƶ��V�m��W��u%��9�Bq��lt��U�w�@��t�O�f��:��u��}�tq��(\�+e�$̍�Y��F�n~��UH_Mq�6��X~�q" "3a2d�8J򃦡9��aU�B3�}��B�K��ų�$X��]�kJ`R�Ku��щ�ڗ�ɗm�Kk܂n�&'�j@�!�h�� Y�� U\��O��vq��7��j߸��jG��V�o��?3�s�p�� \9�u�<̨lu��jG��h�V�?V`&��acy��xW��;2�e�7��_�la��6k�$��K��A�9��'Yv��/Ӯb�9)v�`�b�&d�R+��RBa��I>\��}��5%9L4DX+>Jc�*\ُ�dI�`��*��D��`��z�ɱ�2�ؐ/��w�=Y�I%�\uJh�M�D:��]-��@��/�%��h$^��z(>(��*�4`[>�*_�P��2��зqa7��d��P��/J^V~�J�`u^�/��2�v��l�I�m�1- $Z�J�k�R�D*�*׷)��qa^lM})��3�?��m�6�Q8��Wl�/}d�E�#wK��#�=3&��k~��1�� N�X;Ҏs��M�&�-}b��d7FpW�wY��}��n�nXpc0&�1ґ(�D�t�Ч:��Ou��r֛�n#�D7��nO��#�5��d��H��tk��-S�lݚ�6�J��g��#�s�a��E:ğ܀��5g��?��4��?�|q��5��?��ZO��O��O�/��<@��w�GU��h�G��y~6l��"��ʐ�ּ��So�_ {�s��o��݅+��B�% ��9OS?k+eL�c۴&��ؚA�k��V��o�)C -y�@%��x�wx� ݵsohx:�e<��#�9�:��K�P�×Oއ�?��x��P��$@��+G�I�c��~V�<�0ႍ�5�ݳ �:+�9��25��VJ~�tME/˖�(��*�tm��TU�!�z!BZ�P6�8Cg�l��g�_�Q©�u(��#�U�M��YF8��r�Sac�,��8�,s@ҵ�!QTš�;��?�:k��*Pe�y��=�p�[Տ�V��E� E3V�%�X0�N�]��s�Y&��Y3��6��K�'�Da�u6�W��㇎��'�L�(�1�8(e+.�b��<�h��W'�Ͼo��ϛ�p��Y�j��?~$�x��5�r_m��x��U-Xpf�V�K�i��X��JZ��s1��y�5�rBw��"z", "��EE79��֮��ӧO��/O�3�N5��d��+�ŝT�R�y�i?��<$R\��g,�<�]>_�M��zI�kb�� l�g�>}z��~�kM�i5J@��d7D��ƪ�-�Ě��93�ܳ��®fhQ�m�R)�j��I��Y��cq��0�齹��N؎Nf��h6��3��@g��-v��F��7�W��C��R�x��I��ܪ:��'C��Z�F��է��x��n�v45�f}a�5��X��v��f�jUA]��E{Ӝ�ZX�A١6i�\:�[��@��{w~z!ً��w�4�xB��7�w0�S�⸁O�f��*�+r�V~��J��G��:�J}��&֠jD��%��|n՜Nh�i'�_��~��Q�j�r�#5��^��B�Z��)�G8�M"�/_�1��۞��~�s�Y$꘹��E,j�%I��@��l�>�]@�fq�(��L>�/ض��{��MÄ��&֔&��Y�@�_�m��~�a+~=�@rК;�4��ntb�N�x�r�]{�jK��V��lHWΝ${'Q�8�K�Edwu5K�Q�#]��Ў.F��o��/�J�:�T��@��l*��߇��s��q��ŭ��}�Xg��g��l;�^��p�h�E�ӕ��BȽ��D��E�*o�F1_�ub��^��r��'47�\��,��{7H��߳��ꭱ�C��9�m�Ap�"�7��z�J��5̃8Ӝ��g��X��6I~�]�s��pFN�',�<;�ābf;��^��G�P0k:��k��(�`߷�W��a'P��\~��&ʓwB �1��P��`�iAP��1^&�>�UG��![=L�� ?�mqO��|C��3~Lɋ�i.oC7��|6M�C��1�ٰ<��GD��N��(�!��0��~șw^��~��~��6�Z/�V3{�{��4a��)��Շ��R��m��v?c{4"�y��̦�pz�5�.#�jB6�<<�!��U!�r��k�l�1�y��7C�vF/��/��ϡތ.��__={��d��%;��my��._��q��_=~��Su~��>=Y��\��Ծ6��O��׳�7��9[�j��fv��nqrÿ�量��'vwv}��r��&?�J�'?_]{xQ�Gj�ה�Ν톪/,A\��}?�<�^��mR��RGX�z��ٱiQ�W<;N��+��=fq~�>�oza�i��j��K%��̻�+a>%�SC��G>X̣��v�q2��}�<'�7~�d��s�$�i��(�7��O��>�imX��c��p��'J��˓>��T0�r��fF��Z�17П��3?��k�Fy�]�)ɯy�l߇� w�Hі��E�z�?�� }��]6�5E>Z�l��h8��n�Q�]��Ȭ��t-�f�y\�*�P�h�xa��=9��I��~�U��Ƕ��N� Z.�ad�M&#[ז ͮX�~%��8�~R��H��AW�Ը*��3Z��$z�'�r�3H-q��k)ŕ5�v��>�9#�3�T�m�P�Ix�ǆ�͓��(9,R|&\-D�㓓�.o��S�-��a~v]��<~w_#]��~}��t�h�s�Ň��|�\�]��_:��b!^ϝ��_��yy|r��Χ��o[͜ϝ��w�Z�t��x_��ٵ��WS��ܜ<�9;u�/.�:;u�_��:9��p^}8�ߴ��y��y��J�i�CkfL�Ss8��.�-��w��j�O�9!"%]kǟts4E��T��J��/�n��C�K:�z�ˑf�LN��q��Mt|�r�s:��hO�aӕ��o�R��$v=�})M�+0]�q��x�R�zb!��q�u�dڑ��׫#a$,��ʔ@V(��HG�NP��Ll��U��H�a�W��O�$Jj�V3Y��4V��<.�)��ތoga~�{Ǳ�0"��C�3�t�aDw��-��K�#�ln��\�O�ډ��(p@�rtPEd��`�ٺ��+m��O��ׅv�eI"��i�mIa]��a�&�Ls`�p��s��] ��c0tN�@�5�4Rӵ��I��^��vb��D2�)��9/ߏ��ʮ<�mJ��uR�7��1�х7sz�K�em� ��=�In��e#�=ءGI��e�k)��T)��~{˷ڑ�8_Ӕ�"�6䟅rM�pM�a1O�@H>J�Y��ɥ2��i�V�q�,y�&l��T��Bw��t��';��n��~H�Kνk�@�Z�V��'F�ۤ8�p5p#�^�/�B�%I@2ؤ�,}`��Az��_V��~�~�fl��}x�-݁�5̙9K�A��lͣp�G&`��a�]��t��s��t8x�+�f,cn��W��m*?�E�@��c�8W�W�ɸ��%w�$�t-Z.}�{<�2@6�聧�"��Q��l#�~41��!J�<��-T�y�g�{&�S�溃U��d}?�dGI�9�|yҭ鄎��O�'kJU�D_��G��OW��:z%/�l%�ş��AG-w�,K��Q��:��*�/G�5�Eؒ&w<��}�gV�X��{+X��,�l�Y��߉��T��[&Q�9��X��|��ӡï(Z��h�2a�|�\�U�oV{J�J.�ρ�a�*��1��,�f��:v<�+`.�]�S~Gѡ��OѮ҄{~��|D��0�lW�!h��G�[��o��aq��q��e�]�⃟e��n��]"O�ʽS��Y��,_�X�.�wϓ�O��.!�ݳ��O6�}��,p|��Oy�;�6�{�Dq��x7�86�#.|I��,��5UJ�+J��,�xz�,s� �-@��颿|oEw�"�˝�t/��q��,��y��:�6�ei��ǌ��c0�T��_�B�;�8�nJN��Y��?P��7,��]" �{��@/�\��G�)N�5�#��o�Y9q�rs��GT�:��KW��$&��6�^��H<�E�H�R�D,��j|r��:�_^n��'��˒p?(�j��R�ӯ$��GgQ�� H��=fv�`�X�6:o��L�*�&�"y�oX��k��>��ֽ��q)�Lw��W)�Z��cs�u+?e��f�;�/.r� �?b��mc8?(>�*�ě�E�9,��Lʯ�݊�"�s�P�8�h��ϖQ��-w��;��Pe'ޒP\��=J�&�Mr_�$�r��p��A��"]<��NG!��q�ă�9�2xm�n��"�h|��&O��G�a�i��1ՠ?��\5�J��u�Ȓ��`R�/��a��Y�,"g��~�G�3�:/!�_B��J��I7I�G��+��fY��(�6�|�H��/$ky��چ��xW,ɶu&\��Fp�M��7��{��:��p��Z�e��"ʯ�-a��WBsE�f)G�-��D<��(<�q��W��ɉ�$@�E� ��F{��ɐD��Lj�k��:��1z|��.�$�W��{�os�>3�zm~�>�) �S�"j�>g_��J�cU��9�N��*��,�z��t��q�-Y��a�=�و�ō-7%�2hЪ�Ӟ��mJ�[|d�O�u@��g�^��,R2��e�Y��fC��U��,��rcC��Nb�u�nbh��|΃�U-��L�;�yH��~��5�v��+�B:�#��/��{�<��AxI>?��dvd�O�>IYe}�<'*@�H��X�e��(�W�WjyR��ɓ�PB}�`a��iD�WµJ�b�=�6��^!f�`�,X"�:��(Mc��՜�߉��bV�[��\L�/YcF�sn*�_��OQ�{��0��V��p��*�0�fG��()��Ka�q~V�P��zH�!��y��C��&��ra6$_�]CWe��O~�E��TA��Ta\5|�o<�NX�WQ�8 ��I7��?$~ƫ�0��?`��4dn��>P��X��'��4*�"xp2:��/+�E�g`2�{��v|�c�U�*��8`!�؍βh��iGi�?�(Iy�̱(^�1̤3��1�E��s�s�i�~�T�o�_�e� ^��_`L �|o��//�C��K"�P� �zӃ��])<��x�f.l�o��y��u��V�o��s!��,t�(m�D`4��/�qg��p��}e��1�-Ҥ�K��,��'kɷ>�ڊ��g^��ث2'��sb.��,I|�}*6��$��MP�e�Bd��O��q�&f�*L�O��"6d��%�/�iȄ��+ϰڣE��=��Q�.?l("�ę�g^�E�XWȸ�x�j��>?fՓ%W`��7�@��n�m�Ħ>DѴZz;½\��7�#l��X�Dk&��n�{�)Üt��0�coD�0k��c-�c}vAr��2d�\v�+RO~80r~o�E�?��?1�U;w�.�Ӯ0(�w@�!��6F��*~uW��%I��$x��)E�H.Z��C�-��u��:�Ղ˘��W9�X�q�=�ؠ�-as/��em˿d �(XN�]Rp4�h�J?�x�!)�]A�L�:{g��/��z�X�6-��ú�kޏG��1Reݴڬ��}��P�g]�b��b�i��@'u��"��L9!��;��c�;�ɤc�0ax4��o"�Jj��ƽbL��M�q�O+�c7d��P��+�-�]��:�^��};�,r(��pvw��QU��MԮҾg۪�G��l#��kgp-��:��E��y�v��i�d��VYW��{N��3;��w͎�K��dQ�8�X�t��UO��?2ۛ��ӁHG�tбL�.�6>��x"��pϮ �8�9.{�?��W�Jȸ��k�g", "��c��5O��\��-|xyN�ڄ�d��ު�|�A�kγz}��@Y��ITD��sz�tW~��d��#�Z��=�J��(O.|��l.�ν�lM��$yQ��~��Ɓ�c��D_��G�eɹ6@2�jn�#��W��P��ta��0[>��Q��UFg{��(�C��Q��yy��V��/��u��cٽ�/O�7lq(�R��j�ɨ�E��PrE��"ϲ(�"P�ΞF>��,��(y3/��=�.�P�uʙ]wi��vRǯ��]yQ�<~j�~J-�!g�JhEhח�(��6��/f"��K��`t`3|�&�؆��إ:h_��I�/��V�o�؋A��v�1�8��W� V�#|��5�m��!��ܧZ��X��YE�Z��;�8��nA�HP��5�D��jT��(hԃeh�=)��m�^;��rM՛��9bO+�UQ$d>F��-��luUH?�5��3�>��=�x8b�r��%Lî�YQaǢÎv?��5�=�F��ҝ*�Wys%m��5.i`�=��,y,8�U%�rfS�T/Xq��am*��c��Ɛ��Xñ�l��wE!�abu��0'�DB�@�?�{��1iq��2��=|O�X)�e6F�pT�l�d=Td�UюY�m5F��f��ʒPW��#��H��G4Y�٣��T4o��tŒ+��]��Bf��/Q@�m�P�X�� g��Р�Y��.a+��h�Q(�eA��IG��@Q"��e)��t�PF�)HV�o9$p}/A�{��C��o9�2��y�ho��\sxk�9E��y��O�=^�?�{GLG�6B�(@�F�|;�3*�9��"��v�(��I�g#�b��p�~��ڵV:�[MYC��Ɣ)�lb�)5�H�KXE�AO"��}��-��m�.�mwb��e2��J��J�˙M��a��<4��fj�ȏ*�{!��[�E�jS��nӲE�7�K��9�>��/��ꋒ��Ӛ�?�uE\�%�V<��ܥj��nb�[Ә�DZ.�!4X�f��P�`;z��ɰh�{�&#��!a1�勹��[pu��.�9�J�O�0�6�;��K��(�a�'֤L�D��U�nol�0�+��o��v}cj�(=�v�/2B��nl'P��h�15gSJ��9�d��ZR(�;��˾:��P��2�t囬��U�j�0g�5��5��N�S/n�6��f<��d"9�Qٓ�e'P��D��&�_��ӵl�d�g��Y��y�m=�)��4^��ߨ��S7J<�r�Y�1�35�l�Y��g9z��]��Y�� ݰ0�7��p�!Q�(��0��T�4�x��9S�(W��X♴��R�^�~��("^Z$d��{4�č�$K�*��Wj��nր\`�Q��0�a��q��w-�H��$7��P,�=�m��@X��şX=�� +@��e�/��W��L��E̶u��}W��9��3L��@_7��н,� ��Y�+wg�Y�.�N��x��)&y%>�eEԛ4�p�[�*ۺ_-G��b��qftZ)��Vh3�K��Ko�)�R��d��ET�e8�fw�2�`��4�ӹ:��!#�X$S+2��/�$�=�T+��;a��\��ѭ�d>��N�oS4餪M�`�av�鷚�f�X��x�r�(�Y��V��C`B��=h�"|�"��"�XeL��#��=�o��/_�q� -�V�[Z�@��6$[u18��Ֆ�Ṕ9�ڷ��~��<;;}q|�ֹ8{��?��\��8#�,p#�׋��e��F�pɡ��t5��#��9�>;�i��5��<��s��ի��z7�^�_��흢ݞb�W�q�,��Ӡux�?w5��mXpǓvC�?��y�f�1C��k�ō�-e��~/0c+@#!Mn�gن>$�/��f�b�oDX-��-�*C�R��n��ŝI��!�Pnv��?�8,#�[� f隳 [��0�>3/��5Iej��ជy�ꬫ�H(P��z�p�+FO5��y��,Jn��k��#rڈi�M�d��\1��Cx�3��t]�w`GN��,�E-`��'��݈�"�E�Bw-��]V�a��y<�iꐲ��y��5ZԚ#[��A��:U��眜M��3��;��A�I1�͆'��H��ܛr��+�#�>'R&j��rgʨ�Qt�l0I��oAJ>��N��qGjZ��yxҵ�@�pe��(�(K��NZ�o��|�)�b}�`��")3G:g�@��#%�'؂|i�U�T#��,�r��kq�wg��i ��u�"hj[M��n7�*[$�\�C ��6t��Po�uX�"��V��,�ۗ0��FW��A��*��x|��T@L��p0�7q�*W|w�1��-�>կ��^��۠>)��r��&f��dl�y�-kD�;+�?<��I�-zժ��g'�M?ꪟ4�n"��n"U��>(��oN��yC��o�k��4��5]��ߟ:7�'oϮK��2�y}~6wn��QJT��SV�6?�_�8�8��ՙ��|@*��n�]��^]��p�|��!��G��l~vsh��˛��K��F�Wg`�.��M�q��w]��]�W�u��g��s�\��̞g��{g~uv�U��1�)�H��2�"��H!vͳ<��"�#�߉͗��ˋ��3�I��y�擄��9R�<"��q+�x�3�c��J�æ`��'['<]G��J.3��|獲J�"� e1|�,�B�� 8�J�:-�ԡp��P��PsO��w0�em�j;2O6��R+C�Ĭ��Lf��8�7G��I��l:��#��$�=�s��RעE��ʉ�w��.�\l��F�X��Z!�@��H�n��E��OUW@6��8~v{;��D��Ꙩ��ط�S7{��aB�`Xb�d��t5kԚ��m�,˶a>�í�� tJqW_��t��8��:�Ċ�~o��N�(w�;KѼ�ﻊ��`��m��״�R��a3�^v��t},>A� G�.(6��Miͯ,˘�&�r�(��;��o�<�E�j3.-1�o��,�l�E^W9֣�xbMEJ�e�cf�>}�kUl9y��e(H��|��s��j�A��g�vW��?Jv��t��A��wH6[au�(~x��SK�b�p~�)��y?�u;�G�� Q�(�9$�H3��>�F�r��7�,��4+��njtM�{�ܘk��0'��)�p'�C��j\�莴>��=J�}ip�lb�)��.�Ϸ�h��n5|��!", "1ee7dTbB��6�Վ~�5Pc9��r:��1��Ъ�$`��-Q3�L5��N��t�K�#�7,�h��w�\vQ(�M�;�O��X�%g�� bh��]��U��5ro��͓4JJ�Pt��T�Iz�۟C��`=��~��?D��_�%��'��;�(V�R��(��/)Az_J|��cbQ��r�/��13�#��y��i}�~��_N�`}u��b�Ҙs�D� z�nVR�Z�ϟ>燌��x�@�Z<�d㇅@�)ر��pk$�>H�8|�g`�b��x��$8P"jE��*�.`��@��,b�n�.x;��|�'�B=��6ú<��'G��g�h�|�D��A�CG�l��ۍ?8dC$��ڭ��EW0��}�{��t?�u&̍�M��`= T�t}��,q��.T��:�L��,�'dG�V,��ҏ�}g�XF�S��C��T]��歝�A{w�cw]�{9��-�M3�K�k��Z�B:]V�ʈ��+ϡ?M�~��ѷN5?��kd&!3�'V��x8��ۦ��W.})�@��}��<ț��9ށ��]�)�a�Nd�yb�R��x�˿Vn�� I�>Hަ��_DşȜ>�݊�ħ��7��x��Ѕ�Q��ʿ,�׊�Z�-��!iI��-k8M&�5b�(��!:�퐭S��)`��*!K��t@c�0��⨪9�D�ˢꙥ�U9�S��tц�]i��.D��^��p'��B�rz��$�S$��>B�%�Y�[% o��}��)Y��u"z��zUw�l��[?�lC�NeZ��C�C4��m�M_��V䯍v�,͜Mt��1~Zqg͂��K�fF��ld'C{h��:��5N'3c2�qI��<:�;k:1ˑWN��k<�(�ҙ��HQ��t9ʃ(�F`Ql[2��Pꬑ��~*��0N�LŹ��N��҆�e��G[g�`��/0��r\TN��h�&��u�7��%E�1�b��ϗ�Y"�$L��tP�q1�*�o$�,PI.�="$�).Vdݐ��TnL��"�aI��p��;k�01��D��D:��R2Z*�ĵX;&q��Ȋ", "��H=�gA�G��.�*Ag��G��6Q(^�$qK�Fg�?B)��H'��;�3a�Z��6�nw��d��:��t�j�j�ڑ��S{_J�HN��Fߝ،�y��xb��=@��]��#q&ġ�.�fϑ)e"�:��4�#ܹd !xZEg��tu"��wd�t�� vN�9r��x�|�.�j��-�`%;#��p8�Q��J��E��[K]��U�G��o�>*0�M��(ꄔ�ܓ6�]�v��r�=��C��4ʐ�t�Z�-��ݭ��)vX��p]�=p��Tk�m�$��k#��*d�VG��~�b{5�9��V� %�~)}?d�u4�@P�CU��9�nmgE�)��?��UC�:O��Ӹ�]�M�'؉��@�]�ł%)d��T٩��9ۢ�.=r��Q��CiN:M8P�HT��I��5Kb�)��@^��Q �Q0K��GK��:��+��a�:��fU��1YcrvӪ+��8CMx)u&`��M��IN��<�jN�oz�9P?��-�H��}��f�>5��,M��f6��~�.-�`J&��A�@�ՙ��`H��<�Q��b߼��y�>��_A�Ut�X�AS��F��fsͮl{��U�ͦ��KMe|�Bz�NJE>�|˗=^��S��U�5��%q�0z)[-(kB��4q�eԋ�U�At�B$Wt��*��9�[v�>V�(��9B��bS*��$d�LuQ֥�P��x�4D�B�,��-y@OS�س�AV/(��R��rh�t��C5@l-&��4��H��T�� z��V�8�Rx��뭴U*EqE<�f`%U��x/�=CDs�$�$��E�&�A1��֌��n��F�+��vw��A\�8BA�U�$.��6��}v�eO�6��j�NYMȜ� ^T�_A��R1*Q��R�JV�+�m]��:��{+L�,�n��[I-�Ύ�jV�=Θ��u��f�P_�R�έ�]3�WIL�ar�*S��5�D��&v�GH2󢍅L�RŽv)V��Uo%{��1E\4��"��/8�>�W�*�z��`fڶ=OM�*q��VY��e@E�#>�m�"!��n9��xu U�5S�_:��CK��VP��]�P�+x��I��g7x�N/��uX��(_�V[�?(h'ߤ��4��Y(��^��Xb\;��]|P��r$��`D�ʘ(RO\�U��K1�TZz�5��W�W;^�0��", "wi��/�A}e=�xwL�z-�"SI��⅕4""!��R�ĕJ��DNHY{�̋�m�HUN,WQ�%�.��k6��"F]��x%"�z_R�H�N��_��#��R߄��k��(;\1��u�4P7]l��|�;)�φ��h��n��$#(��x�$�=��]4��n�ֻi�.vt��a��T��0G��UnY�'�]�D�L:��̦��7��F��\3%dyA��gw��h�f}yM�)w�h�n�A�阩�<��B��B��lVM�ذ��"<0NA;H��zBD��$��ĥ�F�>��H�-� l;X��h��OH��*֪��S��z�4*��!�;�1�P��r�8V�\w͑OA�D�p��E��e�K��>,��u\3� �`�@�y��n�Es�`K��3|'�[��g0��=t��\�c�JP�O�B$��r��W��1tt�K��?��3�y@�B��T�d��X�q=�g��R�姊�4��v�-BO#��(�u�&H�RT�j�Gl��_H�k�?%�)!2��\L��7N7N�ݎ��>�*.��~v��/��G�ST�Q��N�$��J��{K��n,��-Ô�;�tݐ0��L(�x/��ce��,��L�*��F&��-�*w�=R$�s�R&�8��a*r��.��U��P̌�4RF%�mRL��fș��UPE��G��RN��z�'��u\��KKx��r��ק!v]��e]Js�T��),m�g�XS��%�!�E�JtQ��]:��U�#<'غs��Wl��t��X�ƌ`�&��G�0��,�"�ʶ:��(IRT��$�+�r<|�ncJK�\� �u��PĥHr1$�j�5�)+��#��\� &qÛ%�5BνP��$�=�n�p�]-�n��ȬU�^�+N�8E�Y/��$��ģ�q*��Z̉8%��]��ʅT�9��b&Q��<�]4�O'��Hڱ��$��e��@b�H�+"#]�D�8�,ÎdD8�]��֌��!<�� P��)P��#t9�Ө�T�4/~ʃPU�U^��J-b?dV�iAQi�:�#1e��V��Z��{j��&$��)��l�IvE�ܢ��7�"J�N��5%q��Zذ�B\��e��Z�>�5O�Q�V�B�ӡ��~��R As-%y�N��fs��B��,r�PZ�4��H�X�xV�}�J�R�T�@�r��T��\s0FQ�`�qp[;��rny��(r+r�Z䲐�za", "�XŃ�ftY��*o�n��f=�a�ޭ�$"EYkcM$�"m�) 9*4W��ŀ�V�� p3��~�EM��`��z�k�s�|L��ܥ��yP�ǖIA9�ZhY=i��-�j,��Ѹ��p��I ��/5<̣P$�,�˪�u�ClD��F��nP��M��r�ڌ|8�ya8�{�?PZ�,R��TӲ�g�-��0�/��CK��p�r�H� �]�٦��m�y�D�3��Z�i�m�@�$���t[_n�}�1M��sSH7B��:Cc܅.JT�Cg��0&��RGP�d5��CT�z�B5Z�z��j�@��M�F�VSԧ�fb�lc؜�<��|��}Qa�:��@"��Y1zΪ4�/�3�F�M5!;`��0��<."E1��R�jj�E$Y�j��)��5�C��ZqԮ�C#�)u�b&��M֥��q�m� e2��F�6dh�h��]iQ6��/�-��/:Y]�_��ݫ�n%VJ��x`t}��FZ{�a2ޠ�E��a�9Q��Rk�n��- DRQEj�dKa'��[��|�Ţ��=��Z��6��f]D�X]el*8~X4)�p��l��e�0I)l��1b��=\L�Q:��߁��9k4��{!'!U��V�zjGͧ-I��ė�-�e˅2W�Q�jC� Wܮ��3gDH>��Z(ᛟ6�|h��}�Gh�"J=��q�ʯ��HI��=��_x�)��M+�6�߻��U��4�~�;��Xﵪ�*ʪ�bVE⤢�r��}��U��}�'��wA�>�u:�=ǎ�0�ᛴɶV��xU>|�K��40�"��s6D�{�K ��!�*M�ڂ��f@��Y�2!/�J��6�+��oc��g�*�g�t�ٕzft�I�u��n��(�ƛ��L�<9��Ib�g�q��V,ܵ�Q)/$!�tw��e�[7Y�S��]�t��]�aT.��2j��.�;��_7B�롊6Di%��~��!ɮ��6�T)K��R��F�I��r�"Va-�J�%7�iY�^�y�F%!ܥo;��C�>"�m%��l��Q��˱�]{U'�#s��i8�ӽE�%��%��Q�f�ے��뒴�؎W��^3,��[�EC*A��N�d��J��'�H��m*P�YɃXA�L�[��ѻ��h~G,Y�i�U/�М�k��h��+Al9�I�R[׊��t�2�ʵI��R٪y�G$Jx�o�,\͚O��]�r]�S�#��h6q�6�h�q�п�c��naE^��h[}��H�\��6hRP�Ls�:�7�P�)�5~uO/rs�n�{��Պu��A�D�99��'A�DOǂ%��K5��z��@Z�h{RR��(�kY�w��e99K��M��Z��}�q;��(͵�p�k�(�Dw%jn�24��RZ��I�%�9p�H�\�� v��.fX+u�|N��ɻ��᪼?K#��{��V�'�xܷHI��I��G��w+��/)�!ua`ˉ�FC�"��T��S��hG�"��5g$$&��]�I��rc��&�d��$/"֔��l�Z�e:n/�rN@�Z��D�;ud�G�3/�/F��V��+�W1��7d�]0��MR;�Nb\qPpg��bZ9�Ҵ6�.��g0z��&I}#1�Y��0/2uշ�`��(E,HK�7^E�{Vg��C�x�Bp�P��^�̐�GM�#�W.Fk��GBL�`��R�¨A�]yl8�+�{��T_�J��Ϲ�SR��sUj4�=(+�y�v�]�$��|��|�A�ǫA��u��9b��T��WP��r��c9Wi*S��юf�YŅ�Y��W�ڽ�Xɔ��vue5p�e�B��g�t�"1Pc��d�B}�B�� p`�^�"W��`c+V�M�K��*Y��f��M\u��䞘��n�2��Dl��T��<8hbV��m�sn�&��,��[��<��s�b��\��{`@�<�z�=F�@*��0��`�?-��*�I�B�s�*��CU^ÕK�.��&��*��Ct�/+g�c��4Ű��C�R�`[ķ��j촟:nz��T`R�x��*�ia]�[��i�OO��_��k(�N�:A��E�][��:�J�t{<��~g~�ڻ�_��og�,>�� 6��r~)�२k�g��g��a�}ֈ�Ic\B_��ݵB��ߟt�.�l5�rB}� ��Y�&~�9�GH5��dߵBP�*�1��J�Pӵ%\dKXݙw��ښ�(��|�A�t�m"'�)Xɜ��U�(F]DB��KX;\]�0��q�4�6j�<��[<ě��z��7໅�V1�/E�Vd��u'!�L5��Ƴ��0��i�ɧO�4 ��$H��.ԁ_��g��nr4�gh�37{�/xr��:�Y��j5;��hXkν��HrBg��.�z�7��N�2�(�=v6¯I��ʖ0q-}��L0$v0��~a��p�j�Q��8��$I��p�12:�Ν�˛��'g��㓛��D��tR��,�a��H�6u��ڑ��U�ݙ�Z��(;��YkΒl��\҆{|��;��i�ƫ��J�^?^yk0�D�e��rRT��Q��{�5Ԡ�_��{�x��U��)�7J��V%�IˎP�EQ��S�Ղ�z��p�� sS^ �݅��K��W��fe��^DG��R �k��p�tja��^Bcɔ4�d(y�Ѱ��0�U?֨%��]��|�~�F�M�_Q�T��=�UU�-*��t(?(μ��2�J"�US��G��b�e��O�V9tFr�ߴ�o��+aiu��*�LB0:[��O8#;��M8G>�vaX��C�h��B�@�Q)�`�T��L�Li/��]a��B��g�Q"��$|.!�*��uG� A�:؞�P{M��M%��1@=�$V�9�" "92aVG,��S׊�Q�b��Y�7�!�U',��I��)/~�Yֈn~��kH��(��/��7��ʪ�x�'}4"�?�K��5�� Z�)�AR��R�z�ԉ��'�=Y�$�R�uBF��s]ڂ%ŀ� \.`2H��3Ĭ��C��j�N^8��o�gWk3{1�N��w��򗋟ߌ_=~es��͉��]��K3��z1M?]�qO��=y�Ya��vz74~��1<{��p�?��k��m[��xs��+n�/��_�>��,ɉ4��[�~�[��g�w��y�z��Ә/O瞵I�-��g��s��Ng��^G��cϾX��η��_W׆��ڵ�7oƳ��~��z��|��u}s�b��7�y�k��7�ӛ;׸~u~��u��L��)�K��E��hS�j�� ^��%��Θ̇��o�w�j|��&��,�Xtc��К��3S�!~1�1��̘Fck0��{fLFc�o��=�F��Q�TXS��x��H;��Ҍ�U"� J��v�.-��)�u��@�jyQ�ɪ�i,�H��v4��vQ)�"��)�� p�f`U"�� (��!�R��k0�+��g��59E\�:"��b�(m��!d){��߯��H�HFo[�v-&*5��E6�/��5靟jGڐ^P�,H�tf&�9��i��p8�g6pY��!�ա3t6��CH5�2��/��8�0��L��"ɤ�x��bu��t?\��<�J(W��ə�_,�1�&��-X^,�֧D�A��E�j��IA�>��1;ɱ��wD��~�e︇�{��7��?`��R[$�P�^��t-�$�j!qQH_�;/O��a\D.��Q��g��")5(Ur�l��l1��b2u{��n��m覡۶n[�D7&�n��3��_}2�{��Я�O��>��֍�Dp��F�t�OM�0��#곉>��Ǻa��l�Ϧ�14tk�[�nX�>��P��l��<&�0�0F�l�[#�떥[�nٺ5��>�SK�&��О��X ��5��[ܐj -xS�>�`�2�'�C��B*<�/��)�g�+��υ��ǿ�?~J��=GP�?/��Ypƶ�n>>z��o�<��>m��_޼�`�X�O��~�~�~��i��o�bs9d�f��WØ��}��W��ww��[�t~L'��ߵ�B��]��_m�k��ˤLt��O?a�d��g��M-M|M��Y�c��w)��", "1cba�}ٲ⺒�{E�z��Q��<�\N8�0@�I��acV[�G �P�8\.cw��q�5+��8ԋ��QY�^��4(�a_��1��.Ġ��`'�[��bI`P�8T��\�rc�)m$��X��w&��&�M�.ws�5��7$�\��%� �`��v�<7�BpG?O�֥�zW��Ȳ�٢W��)�h=�k��:��PxZLQ�~c�4n.�XXK��ֹR��=�ڀ�@�D��8�+�ѩ3Ώ��z:�C��x�3q�!��am�"?rۄH�)a�ޤ>=�J 1��z�# )}��yR��0B�ק4�h��,Dd��r�_�w,�g�l��$�6��i��p��ݎ#�� p)�^mjm�n�j$Rq��﮿�G`N�KK�~ɝ\;$hQ��ۯ��?�\�ťm��&��+��>�C��W��'�`'q��[=�=��{W}v��#?�32�)�?U�� w=��u��wAdW> ��rs�<�Z5׏�x$0��q밃��ȏA۩@�S�ޙ�L$z Mȸ��:Ca�^��;ĀIb0��k�؝x��N�B~��`��@�ʖ3��."��%�,~�,P��,^vK��J"��yF�Z͟��:�Z-��E�.vG� ��W[p^c�:��:t޷�r �r� ��:z��k[gS(q}�:3��X%�2��gk��j��I�j��v�Η'��c9��-H��ʍĦ,��Ն8�m�±X�E��N��n�&&��d�K&MKH�Sʱv��V��Py�47��خ�)��bdj��=��'[B�kQU7��`��E��A]zU��B��~��iM67�B�D�w�t�M�Ҙ�eX%ŊP_ͫ��#��N�;�", ">��++R#7`&K�3��`J��v�ڙ��|��:�e�dU��}(�rc�)&7�r��~:��a��B~�qS�lG��gkܭ)�"�pF��JS��f�\۝b��v:磖�(o��Y�U��Γ�HD9#Mqf�M�q��$_5J5mel�N�6�3�U��Knp��,�j�&`r�bOt4�u�PUu��4p�E��D�;��Ny�/�jThU!�ak��;�Lg�"�b��N~��l[A��R��/A)F�~S��+��Xƺs��B/��@u?��$:.E䐤��T��튤��͊��OG��j*�@�#��*s��)�s#�)D��]}��&0�C�kW�]��G�)�w�U9(�%�,��?��K�sA=�ק�~32s��b��x/�ޛ��^&��f0��TBz#t��(�b��.�g�Y��|!p�94��g��8c�1.w�uK�P�ygv̩��->2�V�ߞ�u[��#V�t��+�[��\�=��)�_�7�|S_��حظRL�֮fA��:c��W!��Fݠ��A@噧�(A}��0�C|�7�}��gBE�P��}�?C�)%��&Vk.�Zo�[�{�M�/�W�MP��2�g��E�L�,{Ϊ��,��ɛ��LB�a�8t�oԴ=z�Z��J��}^THc�"�i\�;�_yT'��ٚĎH��D�7�J_��P1_F��@\��k��C��t�ߍ��+�b5L��mqzgW�P)��FjuJ��>�5<��z�$)*_�y��<Ԓd\�[�ҕ��8V��K�{��d�Sur�v�eq�=2�=�K��)L��7��k�ڸ�{� � �ٵ2h9/��1�/��ɀ��*q� ��#��J�6ԇn�%�h��^B��ڞ�m��软3؉��H�ع_n��lc�+M�&�Ң�!��s�xf��!��Gjh��w�wۭv9w�+��/�KFh܏U_^��d��2��m��_RLE#��e�!P9Q�)bơV�!��:��Žo�G�P�Lqx�Y�k��ƣ|(�}��M�0֦�Pj��dq�KR&�b78��8l�+��}�b��9��g�۹��AKɑ��U�!�|�Y�s4j��T3�|��[Ŵ�$�i+r�s�K&��1�sT��%Q��I��ݘyN��.�^�|��o��d�5��"�R"��U��8v��0.�CjF0��M�wo��F�ܚ�=;?9m�!�#PȔ(3�v��l�L��ʬ)5��ݑ��µ�fE_MG�k�?Vs�ݠ߳��:c]@q 1��I'�sm��z�dg��kW�]�2%3=,Nh��Vi��Q��R��r��9S�)�d%��a�v��K�"=��A��}�u�g=�y��`1s5�9Yq}f@��E�e'Ŭ��6��`.d�>��pF��e��F��ycjy��+�In�Əz��D��b�7f�K�|�d��qFe'��4,�\͞8�W��Fq�Ju��I�dnπX�{d��Kֳ0�գ8��2�f�Ky��եK�̼ĉ��x/G�ѰCf_x��9�z�]�%�u��Ei?�H%�� u�U��G��ټ�N��y[=Z~��U��t*Z��~�ܵ�I�@SR��ɢ9��S�W��kAŇß��A��tUv�1��!5�#2N��gH��V9�Pqz��az��L��4�2�اs��[�#;��Ǯ�oo��x\��t��|��Iѳ��׷h�7�j��[�-�Y��mk)_��۷�~�o��<��Ѷ��?�NR�:��6��3<8�u:��qU0ď7V��oo�*��R��)�ux4>z��;L��rfGH�p�h�M�[.ڄ[-�7?�6$�E��疄�ʢB4�hHɮ�:!{��L"�DC��Kc�uDJ��6Ȩ��tA�σ�)9�}4��8�:�D𰪉��w�C�� Y&�ΰ/�ύw-�B��6�-�:�}��=i��E�� B]`�|��ݞn�)�|l��S'��k��)�im�}ڽT�"P)|��rH��g��My�A��qk.ag" Heuristic match: "ol.cl" Heuristic match: "5@.se" Heuristic match: "m(l.re" Heuristic match: "l,a&.ci" Heuristic match: "ilgj.id" Heuristic match: "*npy.je" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "http://c.pki.goog/wr2/obfyyahzgvi.crlbqvsphr}bwukh" Pattern match: "http://c.pki.goog/wr2/9uvbn0w5e6y.crl=iyie9mg,ahvbmiid&?#" Pattern match: "7dmsn.com/92171758437123127265353153879531271265muid02d39b393fb56c0a38cb8c8b3e706dffmsn.com/102521255560963134969953153879531271265_edge_vmsn.com/921621255560963134969953153879531271265usrlocmsn.com/921742639523843141829653247479731271265" Pattern match: "7dmsn.com/92171758437123127265353153879531271265muid02d39b393fb56c0a38cb8c8b3e706dffmsn.com/102521255560963134969953153879531271265_edge_vmsn.com/921621255560963134969953153879531271265" Pattern match: "7dmsn.com/92171758437123127265353153879531271265muid02d39b393fb56c0a38cb8c8b3e706dffmsn.com/102521255560963134969953153879531271265" Pattern match: "7dmsn.com/92171758437123127265353153879531271265" Pattern match: "muid1554c08f10eb6c8a3caed73d11d46d5cmicrosoft.com/1025205555609631349699415097395531271264_edge_vmicrosoft.com/9216205555609631349699415097395531271264srchdaf=noformmicrosoft.com/1024418395238431418296415097395531271264srchuidv=2&guid=dd62103cb80e4b7b81785" Pattern match: "3a07zwww.msn.com/102442539523843141829653153879531271265muidb02d39b393fb56c0a38cb8c8b3e706dffwww.msn.com/921621255560963134969953153879531271265" Pattern match: "muid1554c08f10eb6c8a3caed73d11d46d5cmicrosoft.com/1025205555609631349699415097395531271264_edge_vmicrosoft.com/9216205555609631349699415097395531271264srchdaf=noformmicrosoft.com/1024418395238431418296415097395531271264" Pattern match: "https://www.google.com/favicon.ico" Pattern match: "9217269186969631289349391210754031271248ukl6amwyqxi5nqgovsiilyrsfacebook.com/9217423632384031351710391273154131271248" Pattern match: "3a07zwww.msn.com/102442539523843141829653153879531271265" Pattern match: "muid1554c08f10eb6c8a3caed73d11d46d5cmicrosoft.com/1025205555609631349699415097395531271264_edge_vmicrosoft.com/9216205555609631349699415097395531271264" Pattern match: "5irzubmdfmuizml7accounts.google.com/9217285237888031418095132448098731271250" Pattern match: "muidb1554c08f10eb6c8a3caed73d11d46d5cieonline.microsoft.com/9216205555609631349699415097395531271264" Pattern match: "muid1554c08f10eb6c8a3caed73d11d46d5cmicrosoft.com/1025205555609631349699415097395531271264" Pattern match: "consentwp.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "ocsp.digicert.cn" Heuristic match: "get /mfewtzbnmeswstajbgurdgmcgguabbtfqhljklejqzpin0kczkdaqpvyowqust7daqp4v0cb1jgmgggc72nkk8mcea59dsncqddhv39mzstnbr0%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.digicert.cn" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "ssl.gstatic.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.facebook.comconnection" Pattern match: "fb.me/p3pset-cookie" Pattern match: "https://www.fbsbx.com" Pattern match: "rsrc.php/v5/yp/l/0,cross/agrw5gzkrkaaxgiecuhi-2xgo-3469oigt9dwdypz6dhfgqe914iibfd-gevamvu9konmkn3yhinqu49pvnahkckvx2i9b7pb8k.css" Pattern match: "www.xx.facebook.com\/ajax\/browser_error_reports\/}],group:permissions_policy}timing-allow-origin" Pattern match: "rsrc.php/yh/r/ur_tiyve0g0.eot" Pattern match: "rsrc.php/yp/r/kuc6ohi0fjd.woff" Pattern match: "rsrc.php/yp/r/oijsl4a27yl.webp" Pattern match: "rsrc.php/yf/r/ipwqpkyh2fy.ttf" Pattern match: "rsrc.php/y1/r/ay1hv6olegs.ico" Pattern match: "https://accounts.google.com/servicelogin?passive=1209600&continue=https%3a%2f%2faccounts.google.com%2f&followup=https%3a%2f%2faccounts.google.com%2fcontent-encoding" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&dsh=s1343172368:1786423738583884" Pattern match: "https://accounts.google.com/interactivelogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&dsh=s1343172368:1786423738583884strict-transport-security" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3a%2f%2faccounts.google.com%2f&dsh=s1343172368%3a1786423738583884&followup=https%3a%2f%2faccounts.google.com%2f&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&ifkv=ac50bxtwqfka_" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://accounts.google.com/accept-language" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}cross-origin-opener-policy-report-only" Pattern match: "https://www.google.com/favicon.icox-content-type-options" Pattern match: "https://accounts.google.com/&dsh=s1343172368:1786423738583884&flowentry=servicelogin&flowname=weblitesignin&followup=https://accounts.google.com/&ifkv=ac50bxtwqfka_dzlb6zaxoekbckaxmyuonivdnh5gxqaezfrqtl7rx2lugwyyzvk87bgyxcfpfjkdg" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninui}]}cross-origin-opener-policy-report-only" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}accept-ch" Pattern match: "https://accounts.google.com/&dsh=s1343172368:1786423738583884&flowentry=servicelogin&flowname=weblitesignin&followup=https://accounts.google.com/&ifkv=ac50bxtwqfka_dzlb6zaxoekbckaxmyuonivdnh5gxqaezfrqtl7rx2lugwyyzvk87bgyxcfpfjkdg&pstmsg=1" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninui}]}accept-ch" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}content-encoding" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninui}]}cross-origin-resource-policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}content-length" Pattern match: "https://accounts.google.com&v=-617842373×tamp=1786426438024" Pattern match: "https://accounts.google.comcontent-security-policy" Pattern match: "https://accounts.google.com&v=1556965028×tamp=1786432328135" Pattern match: "https://accounts.google.com&v=1105818230×tamp=1786432427533" Pattern match: "https://accounts.google.com&v=160632117×tamp=1786432581957" Pattern match: "https://accounts.google.com/" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "ixp003.tmp/1dm49pq2.exe" Heuristic match: "mp\ixp003.tm"62:T48b,Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")63:T587,GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue 11 Aug 2026 03:35:49 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue 11 Aug 2026 00:09:16 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog 64:T4ba,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEA59dSNcqDd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"65:T82e,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetDC" (Indicator: "GetDC"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")66:T43f,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; File: "00000000-00004788.00000000.119983.00401000.00000020.mdmp") Found reference to API "26384,4616,3024,,RtlGetVersion,NTDLL.dll,"252:16:19.881",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp") Found reference to API "150792,4400,3024,,RtlGetVersion,NTDLL.dll,"252:16:36.605",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found reference to API "401160,3348,3024,,RtlGetVersion,NTDLL.dll,"252:16:18.914",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp") Found reference to API "895092,2932,3024,,RtlGetVersion,NTDLL.dll,"252:16:31.113",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found reference to API "795036,4600,3024,,RtlGetVersion,NTDLL.dll,"252:16:18.275",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00003944.00000000.118460.00310000.00000004.mdmp")67:T529,Found registry query API: "RegQueryInfoKeyA" in file "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" Found registry query API: "RegQueryValueExA" in file "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" Found registry query API: "RegOpenKeyExA" in file "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78" Found registry query API: "RegOpenKeyExA" in "00000000-00001644.00000000.118622.0034A000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00001644.00000000.118622.0034A000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001644.00000000.118622.0034A000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002292.00000000.118544.0005A000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00002292.00000000.118544.0005A000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002292.00000000.118544.0005A000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp"68:T6fb,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindNextFileW" with parameter 5yy8rn9.exe (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindNextFileW" with parameter Ll8cp20.exe (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00003944) "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003944) "Ll8cp20.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00002292) "Ll8cp20.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002292) "Ll8cp20.exe" called "FindNextFileW" with parameter 4wu689py.exe (UID: 00000000-00002292) "Ll8cp20.exe" called "FindNextFileW" with parameter UU5HX65.exe (UID: 00000000-00002292) "Ll8cp20.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00002292) "Ll8cp20.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002292) "UU5HX65.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00004044) "UU5HX65.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004044) "UU5HX65.exe" called "FindNextFileW" with parameter 3pt32Vf.exe (UID: 00000000-00004044) "UU5HX65.exe" called "FindNextFileW" with parameter bk3UW74.exe (UID: 00000000-00004044)69:Tdd3,file/memory contains long string with (Indicator: "aes"; File: "SSL") Found string "FromBase64" (Indicator: "base64"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string "system.security.cryptography.algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string "system.security.cryptography.encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found string "system.security.cryptography.algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp") Found string "system.security.cryptography.encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002448.00000000.119312.003A0000.00000004.mdmp")6a:T7fe,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")6b:Tf93,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp, 00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00001684.00000000.119646.00BB3000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")6c:T57a,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")6d:T81e,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")6e:Tf90,Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "00000000-00004512.00000000.118977.00271000.00000020.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp")6f:T43a,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")70:T12e4,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000512.00000000.118633.00450000.00000004.mdmp, 00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000512.00000001.118643.00450000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\bk3UW74.exe" (Indicator: "\Device\"; Source: "00000000-00001644.00000000.118622.001F0000.00000004.mdmp, 00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\4wu689py.exe" (Indicator: "\Device\"; Source: "00000000-00001684.00000000.119641.003B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp, 00000000-00002292.00000001.119653.001E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002292.00000000.118544.001E0000.00000004.mdmp, 00000000-00002292.00000001.119653.001E0000.00000004.mdmp")71:T700,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "4846666,4616,3136,,RemoveDirectoryA,kernel32.dll,"252:16:30.084",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00001644.00000001.118983.001F0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "9609224,3348,3136,,RemoveDirectoryA,kernel32.dll,"252:16:40.551",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00002292.00000001.119653.001E0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")72:Tc99,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000512.00000000.118633.01FB0000.00000004.mdmp, 00000000-00000512.00000001.118643.01FB0000.00000004.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001644.00000001.118983.00341000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001644.00000001.118983.00341000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002292.00000000.118544.00051000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002292.00000000.118544.00051000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003944.00000000.118460.00D71000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003944.00000000.118460.00D71000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")73:Tded,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "00000000-00000512.00000001.118643.00B12000.00000020.mdmp") Found reference to API "DeleteAce" (Indicator: "DeleteAce"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00000512.00000001.118643.00B12000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "DeleteAce" (Indicator: "DeleteAce"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "DeleteAce" (Indicator: "DeleteAce"; Source: "00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")74:T8c6,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00004512.00000000.118977.00271000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001684.00000000.119641.00BA9000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002448.00000000.119307.00C33000.00000004.mdmp, 00000000-00002448.00000000.119312.00C29000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")75:Tda2,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Ll8cp20.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Ll8cp20.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Ll8cp20.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Ll8cp20.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Ll8cp20.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: UU5HX65.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: UU5HX65.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: UU5HX65.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: UU5HX65.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: UU5HX65.exe] Observed import api "DeleteAce" which can "delete an access control entry (ACE) from an access control list (ACL)" [Source: 4wu689py.exe] Observed import api "DeleteAce" which can "delete an access control entry (ACE) from an access control list (ACL)" [Source: 3pt32Vf.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: bk3UW74.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: bk3UW74.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: bk3UW74.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: bk3UW74.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: bk3UW74.exe] Observed import api "DeleteAce" which can "delete an access control entry (ACE) from an access control list (ACL)" [Source: 2Zc0213.exe]76:Tc96,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Ll8cp20.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "UU5HX65.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "bk3UW74.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\FEATURES"; Key: "TAMPERPROTECTION"; Value: "0000000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEANTISPYWARE"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEBEHAVIORMONITORING"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEIOAVPROTECTION"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEONACCESSPROTECTION"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLESCANONREALTIMEENABLE"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER SECURITY CENTER\NOTIFICATIONS"; Key: "DISABLENOTIFICATIONS"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "AUOPTIONS"; Value: "0200000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "AUTOINSTALLMINORUPDATES"; Value: "0000000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "NOAUTOUPDATE"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "NOAUTOREBOOTWITHLOGGEDONUSERS"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "USEWUSERVER"; Value: "0100000000") "1dM49pQ2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE"; Key: "DONOTCONNECTTOWINDOWSUPDATEINTERNETLOCATIONS"; Value: "0100000000")77:T43e,Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") file/memory contains long string with (Indicator: "ExitWindows"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00001644.00000000.118622.0034A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00002292.00000000.118544.0005A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00003944.00000000.118460.00D7A000.00000002.mdmp")78:T54d,"Ll8cp20.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\Ll8cp20.exe]- [targetUID: 00000000-00002292] "UU5HX65.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\UU5HX65.exe]- [targetUID: 00000000-00002292] "4wu689py.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4wu689py.exe]- [targetUID: 00000000-00002292] "3pt32Vf.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\3pt32Vf.exe]- [targetUID: 00000000-00002448] "bk3UW74.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\bk3UW74.exe]- [targetUID: 00000000-00001644] "2Zc0213.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2Zc0213.exe]- [targetUID: 00000000-00001644] "5yy8rn9.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5yy8rn9.exe]- [targetUID: 00000000-00004788] "1dM49pQ2.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP003.TMP\1dM49pQ2.exe]- [targetUID: 00000000-00001644]79:T47a,Found string "CheckTokenMembership" (Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78, API is part of module: ADVAPI32.DLL) Found string "DelNodeRunDLL32" (Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78, API is part of module: ADVPACK.DLL) Found string "HeapSetInformation" (Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78, API is part of module: KERNELBASE.DLL) Found string "DecryptFileA" (Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78, API is part of module: ADVAPI32.DLL) Found string "DoInfInstall" (Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78, API is part of module: ADVPACK.DLL) Found string "SHBrowseForFolder" (Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78, API is part of module: SHELL32.DLL) Found string "SHGetPathFromIDList" (Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78, API is part of module: SHELL32.DLL) Found string "Extract" (Source: 0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78, API is part of module: URLMON.DLL)7a:T53b,FindResourceA@KERNEL32.DLL at 00000000-00003944-50391-35-00D7468F FindResourceA@KERNEL32.DLL at 00000000-00003944-50391-51-00D74FE0 LoadResource@KERNEL32.DLL at 00000000-00003944-50391-57-00D76298 FindResourceA@KERNEL32.DLL at 00000000-00003944-50391-58-00D76517 FindResourceA@KERNEL32.DLL at 00000000-00003944-50391-71-00D72CAA FindResourceA@KERNEL32.DLL at 00000000-00002292-50882-35-0005468F FindResourceA@KERNEL32.DLL at 00000000-00002292-50882-51-00054FE0 LoadResource@KERNEL32.DLL at 00000000-00002292-50882-57-00056298 FindResourceA@KERNEL32.DLL at 00000000-00002292-50882-58-00056517 FindResourceA@KERNEL32.DLL at 00000000-00002292-50882-71-00052CAA FindResourceA@KERNEL32.DLL at 00000000-00004044-51569-35-00B4468F FindResourceA@KERNEL32.DLL at 00000000-00004044-51569-51-00B44FE0 LoadResource@KERNEL32.DLL at 00000000-00004044-51569-57-00B46298 FindResourceA@KERNEL32.DLL at 00000000-00004044-51569-58-00B46517 FindResourceA@KERNEL32.DLL at 00000000-00004044-51569-71-00B42CAA FindResourceW@KERNEL32.DLL at 00000000-00004788-61256-188-00402C55 FindResourceW@KERNEL32.DLL at 00000000-00004788-61256-189-004026C7 LoadResource@KERNEL32.DLL at 00000000-00004788-61256-203-00402664 FindResourceW@KERNEL32.DLL at 00000000-00004788-61256-242-00403E37 FindResourceW@KERNEL32.DLL at 00000000-00004788-61256-256-00402E497b:T54d,"Ll8cp20.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\Ll8cp20.exe]- [targetUID: 00000000-00002292] "UU5HX65.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\UU5HX65.exe]- [targetUID: 00000000-00002292] "4wu689py.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4wu689py.exe]- [targetUID: 00000000-00002292] "3pt32Vf.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\3pt32Vf.exe]- [targetUID: 00000000-00002448] "bk3UW74.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\bk3UW74.exe]- [targetUID: 00000000-00001644] "2Zc0213.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2Zc0213.exe]- [targetUID: 00000000-00001644] "5yy8rn9.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5yy8rn9.exe]- [targetUID: 00000000-00004788] "1dM49pQ2.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP003.TMP\1dM49pQ2.exe]- [targetUID: 00000000-00001644]7c:T578,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Ll8cp20.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Ll8cp20.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "UU5HX65.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "UU5HX65.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "bk3UW74.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "bk3UW74.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"")7d:Tce9,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ll8cp20.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" wrote 31232 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5yy8rn9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Ll8cp20.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\UU5HX65.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Ll8cp20.exe" wrote 22528 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4wu689py.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "UU5HX65.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\bk3UW74.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "UU5HX65.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3pt32Vf.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "bk3UW74.exe" wrote 12516 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dM49pQ2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "bk3UW74.exe" wrote 20252 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Zc0213.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7e:T558,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5yy8rn9.exe" for deletion "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ll8cp20.exe" for deletion "Ll8cp20.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4wu689py.exe" for deletion "Ll8cp20.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\UU5HX65.exe" for deletion "UU5HX65.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3pt32Vf.exe" for deletion "UU5HX65.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\bk3UW74.exe" for deletion "bk3UW74.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Zc0213.exe" for deletion "bk3UW74.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dM49pQ2.exe" for deletion "5yy8rn9.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7EC0.tmp" for deletion "5yy8rn9.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7EC0.tmp\7ED1.tmp" for deletion "5yy8rn9.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7EC0.tmp\7ED1.tmp\7ED2.tmp" for deletion "5yy8rn9.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7EC0.tmp\7ED1.tmp\7ED3.tmp" for deletion "5yy8rn9.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7EC0.tmp\7ED1.tmp\7ED2.bat" for deletion7f:T7dc,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5yy8rn9.exe" with delete access "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ll8cp20.exe" with delete access "Ll8cp20.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Ll8cp20.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Ll8cp20.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4wu689py.exe" with delete access "Ll8cp20.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\UU5HX65.exe" with delete access "UU5HX65.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "UU5HX65.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "UU5HX65.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "UU5HX65.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3pt32Vf.exe" with delete access "UU5HX65.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\bk3UW74.exe" with delete access "bk3UW74.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "bk3UW74.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "bk3UW74.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "bk3UW74.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "bk3UW74.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Zc0213.exe" with delete access "bk3UW74.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dM49pQ2.exe" with delete access "5yy8rn9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\7EC0.tmp\7ED1.tmp\extd.exe" with delete access80:T634,Wrote 164 instructions to a remote process Wrote 112 instructions to a remote process Wrote 73 instructions to a remote process Wrote 2 instructions to a remote process Wrote 89 instructions to a remote process Wrote 10 instructions to a remote process Wrote 94 instructions to a remote process Wrote 42 instructions to a remote process Wrote 12 instructions to a remote process Wrote 22 instructions to a remote process Wrote 23 instructions to a remote process Wrote 57 instructions to a remote process Wrote 13 instructions to a remote process Wrote 74 instructions to a remote process Wrote 27 instructions to a remote process Wrote 20 instructions to a remote process Wrote 5 instructions to a remote process Wrote 9 instructions to a remote process Wrote 67 instructions to a remote process Wrote 21 instructions to a remote process Wrote 11 instructions to a remote process Wrote 24 instructions to a remote process Wrote 87 instructions to a remote process Wrote 7 instructions to a remote process Wrote 54 instructions to a remote process Wrote 30 instructions to a remote process Wrote 46 instructions to a remote process Wrote 17 instructions to a remote process Wrote 113 instructions to a remote process Wrote 65 instructions to a remote process Wrote 19 instructions to a remote process Wrote 40 instructions to a remote process Wrote 88 instructions to a remote process Wrote 48 instructions to a remote process Wrote 16 instructions to a remote process Wrote 39 instructions to a remote process Wrote 25 instructions to a remote process81:T11d55,Observed string: ""WalletECNewCtaDescriptionCashback": "ativar o programa de reembolso", "WalletECNewCtaDescriptionCoupon": "aplicar cupes automaticamente", "WalletECNewCtaDescriptionFillAddress": "preencha automaticamente as suas informaes de envio", "WalletECNewCtaDescriptionFillDetail": "preencha as suas informaes de envio e fatura "WalletECNewCtaDescriptionFillPayment": "preencher as suas informaes de fatura "WalletECNewCtaDescriptionGiftCard": "utilizar o carto de oferta", "WalletECNewCtaDescriptionTakeToBNPL": "encaminh-lo para $1", "WalletECNewUXErrorMessageForAutofill": "O preenchimento automtico no conseguiu preencher todos os seus detalhes. Introduza-os manualmente para concluir a transao.", "WalletECNewUXErrorMessageForCashback": "No foi possvel aplicar o reembolso sua compra neste momento. Tente novamente mais tarde.", "WalletECNewUXErrorMessageForCoupon": "Os testes de cupes no esto disponveis neste momento mas ainda pode testar cupes manualmente.", "WalletECNewUXErrorMessageForGiftCard": "No conseguimos aplicar o seu carto de oferta a esta compra. $1", "WalletECNewUXErrorMessageForGiftCardLink": "Ver o estado do carto de oferta", "WalletECNewUXForNoSuccessMessage": "Pedimos desculpa mas no conseguimos ajudar neste momento", "WalletECNewUXForNoWorkingCoupon": "No encontrmos cupes vlidos", "WalletECNewUXMultiErrorMessageForAutofill": "preenchimento automtico", "WalletECNewUXMultiErrorMessageForCashback": "reembolso", "WalletECNewUXMultiErrorMessageForCoupon": "cupes", "WalletECNewUXMultiErrorMessageForiftCard": "carto de oferta", "WalletECNewUXPartialSuccessMessageForAutofill": "Alguns dos seus detalhes foram preenchidos. Introduza as informaes restantes para concluir a sua compra", "WalletECNewUXSSuccessMessageForCouponAndGiftCard": "J poupou $1 com o melhor cupo e carto de oferta", "WalletECNewUXSuccessMessageForAutofill": "Os detalhes da finalizao da compra foram preenchidos", "WalletECNewUXSuccessMessageForCashback": "Receber $1 de reembolso $2", "WalletECNewUXSuccessMessageForCoupon": "J poupou $1 com o melhor cup "WalletECNewUXSuccessMessageForGiftCard": "J poupou $1 com o carto de oferta" "WalletECSimplifyAutofillSubTitle": "Ativar para utilizar a concluspida" "WalletECSimplifyAutofillTitle": "Detalhes do preenchimento automtico da finalizao da compra" "WalletECUXSimplifyCtaDescriptionSaving": "aplicar poupan "walletBNPLSmallCardBottomMessagePayInFour": "O $1 tambm oferece pagamentos mensais com juros.", "walletBNPLSmallCardBottomMessageZip": "O Zip tambm oferece pagamentos mensais com juros.", "walletBNPLSmallCardFooterMessage": "A Microsoft no lhe cobra nem paga por estes fornecedores.", "walletBNPLSmallCardTitle": "A compra ser dividida em quatro prestaes", "walletBNPLSmallCardTitleBothFinancedAndPayInFour": "A compra pode ser dividida em 4 prestaes", "walletChangeYourSettings": "alterar as definies", "walletDrawerFormPageMicroFeedbackPrompt": "Est contente com a Carteira?", "walletDrawerGiftCardAuofillMultipleFailureTitle": "Aplique automaticamente o seu carto de oferta a esta encomenda. Verifique o nmero do carto de oferta no seu e-mail e introduza-o manualmente para utiliz-lo.", "walletDrawerGiftCardAutofillFailureTitle": "No foi possvel aplicar automaticamente o seu carto de oferta a esta encomenda. Verifique o nmero do carto de oferta no seu e-mail e introduza-o manualmente para utiliz-lo.", "walletDrawerGiftCardRedeemFailureTitle": "No foi possvel resgatar os seus pontos do Rewards como carto de oferta. Pode continuar com a encomenda ou tentar a transao novamente mais tarde.", "walletDrawerGiftCardRedeemMultipleFailureTitle": "Resgate os seus pontos do Rewards como carto de oferta.", "walletECAllFailureMessageBottom": "No se preocupe ainda pode continuar a sua transao.", "walletECAllFailureTitle": "As seguintes funcionalidades no esto disponveis neste momento:", "walletECApplyCashBackTitle": "Reembolso", "walletECApplyCashCackTitle": "Receber $1 em reembolso.", "walletECApplySavingTitle": "Poupar $1 e receber $2 em reembolso.", "walletECAutoApplyApplyingBestCouponsNew": "Aplicando o melhor cupo que encontrmos...", "walletECAutoApplyFailureTitle": "Os testes de cupes no esto disponveis neste momento mas ainda pode testar cupes manualmente.", "walletECAutoApplyFeature": "Cupes de teste", "walletECAutoApplyTryingCoupons": "A tentar $1...", "walletECAutofillErrorMessage": "Detalhes da Preenchimento Automtico", "walletECAutofillPaymentOnlySingleErrorMessage": "O preenchimento automtico no conseguiu concluir todos os seus detalhes. Introduza-os manualmente para continuar a sua transao.", "walletECAutofillPaymentOnlySuccessMessage": "Preenchemos automaticamente os seus dados de pagamento para uma finalizapida da compra.", "walletECAvailableRewardsPoints": "$1 pontos disponveis", "walletECCancelCouponButton": "Ignorar cupes", "walletECCancelCouponFooter": "45% dos utilizadores pouparam com cupes", "walletECCancelCouponStatus": "A aplicao de cupes cancelada", "walletECCashBackAndCouponTitle": "Reembolsos e cupes", "walletECCashBackDisplayValue": "At $1", "walletECCashBackEnableErrorMessage": "No foi possvel aplicar o cashback sua compra neste momento. Tente novamente mais tarde.", "walletECCashBackEnableSubErrorMessage": "Ativar cashback", "walletECCashBackInfo": "Receber atualizaes por e-mail e monitorizar os detalhes dos reembolsos em $1.", "walletECCashBackOptionText": "Obter reembolso", "walletECCashBackUpto": "At $1", "walletECCashbackActivateFailedLabel": "No foi possvel ativar o reembolso desta compra. Tente novamente mais tarde.", "walletECCashbackActivateLabel": "Ativar reembolso", "walletECCashbackEnrollDisclaimer": "Ter sesso iniciada no Microsoft Edge que ir fazer uma cpia de segurana dos seus dados de navegao e permitir-lhe ver os seus favoritos palavras-passe histrico e muito mais em todos os seus dispositivos. Tambm ir aderir e receber e-mails sobre o $1 que incluem ofertas sobre produtos de parceiros. $2 | $3", "walletECCashbackLinkLabel": "Ver detalhes da oferta no valor de $1", "walletECCashbackPrivacyLinkLabel": "Privacidade e Cookies", "walletECCashbackSigninLabel": "Aderir agora e ative o reembolso", "walletECCashbackStatus": "Reembolso ativado", "walletECCashbackTermsLinkLabel": "Termos", "walletECContinueSavingsAndFillDetailsButtonLabel": "Aplicar poupanas e continuar", "walletECContinueSavingsAndFillDetailsLabel": "Ao continuar ativaremos o programa de reembolsos aplicaremos cupes automaticamente e preencheremos as suas informaes de envio e faturao.", "walletECContinueSavingsAndFillDetailsLabelBNPL": "Ao continuar ativaremos o programa de reembolsos aplicaremos cupes e preencheremos automaticamente o seu envio e o levaremos a $1.", "walletECContinueSavingsAndFillDetailsNoCouponLabel": "Ao continuar ativaremos o programa de reembolsos e preencheremos as suas informaes de envio e faturao.", "walletECContinueSavingsAndFillDetailsNoCouponLabelBNPL": "Ao continuar ativaremos o programa de reembolsos preencheremos automaticamente o seu envio e o levaremos a $1.", "walletECContinueSavingsButtonLabel": "Aplicar poupanas", "walletECContinueSavingsLabel": "Ao continuar iremos ativar o programa de reembolso e aplicar cupes automaticamente.", "walletECContinueSavingsNoCouponLabel": "Ao continuar ativaremos o programa de reembolsos.", "walletECCouponAverageSaving": "Em mdia poupou $1", "walletECCouponOptionText": "Utilizar cup "walletECCouponsCookieDisclaimer": "Permito a colocao de $1 no meu dispositivo para ajudar a faturao com o fornecedor do cupo tal como por $2" "walletECCouponsCookieDisclaimerPrivacyLinkLabel": "Declarao de Privacidade da Microsoft" "walletECEnjoyMessage": "Desfrute do resto do seu percurso de compras." "walletECFillDetailsButtonLabelUXSimplify": "Preencher detalhes" "walletECFreBannerContent": "Encontre as melhores ofertas com cupes e reembolsos, tudo antes de pagar." "walletECFreBannerTitle": "Poupe dinheiro e tempo com a Carteira no Microsoft Edge" "walletECGetCashbackLabel": "Pode obter um reembolso de at $1 em $2." "walletECGiftCardTitle": "Carto de oferta" "walletECManagePersonalInfo": "Gerir informaes pessoais" "walletECMaskedCardDetailFetching": "Introduza o seu CVC para continuar" "walletECMaskedFetchErrorMessage": "Tente novamente e introduza o seu CVC quando lhe for solicitado. Em alternativa, selecione outro mtodo de pagamento para continuar." "walletECNewCtaDescriptionTemplateFive": "Ao continuar, iremos $1, $2, $3, $4 e $5." "walletECNewCtaDescriptionTemplateFour": "Ao continuar, iremos $1, $2, $3 e $4." "walletECNewCtaDescriptionTemplateOne": "Ao continuar, iremos $1." "walletECNewCtaDescriptionTemplateThree": "Ao continuar, iremos $1, $2 e $3." "walletECNewCtaDescriptionTemplateTwo": "Ao continuar, iremos $1 e $2." "walletECNewShippingAddressTitle": "Detalhes do envio" "walletECNewUXErrorMessageTemplateFive": "Os $1, $2, $3, $4 e $5 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateFour": "Os $1, $2, $3 e $4 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateThree": "Os $1, $2 e $3 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateTwo": "Os $1 e $2 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNoSavedAddress": "Sem Endereo Guardado" "walletECNoSavedName": "Nenhum Nome Guardado" "walletECRebatesCouponsSelectorDescription": "Aplicmos as melhores poupanas para si e descobrimos que s pode utilizar uma nesta compra. Selecione uma das opes abaixo para continuar." "walletECRebatesCouponsSelectorTitle": "Selecione um para continuar" "walletECReturnToCheckoutButtonAria": "Fechar o painel e regressar gina de finalizao da compra" "walletECRewardsDonotRedeemOptionPoints": "No resgatar pontos de recompensas" "walletECRewardsNoGiftCardSelected": "Nenhum carto de oferta selecionado" "walletECRewardsPointsAndAvailableRewardsPoints": "$1/$2 pontos" "walletECRewardsRedeemOptionPoints": "$1 pontos" "walletECRewardsRedeemOptionTitle": "Resgatar carto de oferta de $1" "walletECRewardsTitle": "Carto de oferta do Microsoft Rewards" "walletECSavingsButtonLabelUXSimplify": "Aplicar poupanas e preencher detalhes" "walletECSavingsDisableMessage": "$1 para ativar o reembolso e aplicar cupes automaticamente. Isto pode poupar-lhe tempo e dinheiro quando fizer compras no Edge." "walletECShoppingInfo": "Est a utilizar cupes e reembolsos de compras da Microsoft." "walletECShoppingInfoForCoupon": "e cupes" "walletECShoppingInfoNew": "Est a utilizar o reembolso de $1 para compras da Microsoft." "walletECSkipCouponProgressStatus": "A ignorar cupes..." "walletECThirdPartyCookies": "cookies de terceiros" "walletECTokenizationCardDetailFetching": "Estamos a estabelecer uma ligao com o seu banco para gerar os detalhes do carto para esta transao. Isto pode demorar alguns segundos." "walletECTokenizationFetchErrorMessage": "N possvel gerar os detalhes do carto virtual. Tente novamente ou escolha outro carto." "walletECUXAffirmDescription": "Dividir pagamentos ao longo de 8 semanas" "walletECUXAffirmDescriptionFinanced": "Compre agora, pague ao longo do tempo com o Affirm." "walletECUXBNPLDropdownTitle": "Pagar ao longo do tempo" "walletECUXCardKlarnaDescription": "Sem taxas de juros, podero aplicar-se taxas de atraso" "walletECUXKlarnaDescription": "Compre agora. Pague ao longo do tempo com a Klarna." "walletECUXManagePaymentButtonTitle": "Gerir mtodos de pagamento" "walletECUXNewAddressDropdownLabel": "Selecionar endereo para envio" "walletECUXNewOnlyCardDropdownTitle": "Pagar com cart "walletECUXNewPaymentDropdownLabel": "Selecionar mtodo de pagamento", "walletECUXNewPaymentDropdownTitle": "Pagar com carto ou pagar ao longo do tempo", "walletECUXSBillingTheSameWithShipAddress": "O endereo de fatura o mesmo que o endereo de envio", "walletECUXSInEligibleCardLogoContent": "Este site no suporta cartes virtuais", "walletECUXSTokenCardLogoContent": "Nmero de carto virtual $1 ativado para proteger as suas informaes de pagamento", "walletECUXSmallCardAffirmDescription": "Sem taxas de atraso sem juros", "walletECUXSmallCardZipDescription": "Sem impacto na classificao de crdito podero aplicar-se taxas de atraso", "walletECUXZipDescription": "Dividir pagamentos ao longo de 6 semanas", "walletECUXsimplifyBGAANegativeContent": "A Carteira testou todos os cupes mas no encontrou nenhum desconto", "walletECUXsimplifyBGAANegativeTitle": "Tem o melhor pre "walletECUXsimplifyBGAAPostiveCouponContent": "A Carteira testou todos os cupes disponveis" "walletECUXsimplifyBGAAPostiveTitle": "Est a poupar $1" "walletECUXsimplifyCashbackEnrollText": "Obtenha at $1 com o $2" "walletECUXsimplifyCashbackValue": "At $1" "walletECUXsimplifyMutipleCoupon": "$1 cupes" "walletECUXsimplifyOneCoupon": "1 cup "walletECUXsimplifySavingTitle": "Aplicar poupan "walletECUXsimplifyShoppingToggleOffCashback": "Ativar o Microsoft Cashback" "walletECUXsimplifyShoppingToggleOffCashbackAndCoupon": "Ativar o Microsoft Cashback e aplicar cupes automaticamente" "walletECUXsimplifyShoppingToggleOffContentLabel": "$1 para poupar tempo e dinheiro quando faz compras online." "walletECUXsimplifyShoppingToggleOffCoupon": "Aplicar cupes automaticamente" "walletECUXsimplifyShoppingToggleOffTitle": "Ativar as compras no Microsoft Edge" "walletECUXsimplifyStandardCouponContent": "Poupandia: $1 em $2" "walletECUXsimplifyStandardCouponContentForBestOffer": "A Carteira encontrar a melhor oferta para si" "walletECUXsimplifyStandardCouponTitle": "$1 ser testado" "walletSelectString": "$1 ou $2"" (Indicator: ""ver ") in Source: strings.json Observed string: ""WalletECNewCtaDescriptionCashback": "activar el programa de reembolso", "WalletECNewCtaDescriptionCoupon": "aplicar cupones automticamente", "WalletECNewCtaDescriptionFillAddress": "autorrellenar la informacin de env "WalletECNewCtaDescriptionFillDetail": "rellene la informacin de envo y facturaci "WalletECNewCtaDescriptionFillPayment": "rellene la informacin de facturaci "WalletECNewCtaDescriptionGiftCard": "canjear la tarjeta de regalo" "WalletECNewCtaDescriptionTakeToBNPL": "llevarle a $1" "WalletECNewUXErrorMessageForAutofill": "El autorrellenado no pudo completar todos los detalles. Solo tiene que escribirlos manualmente para completar la compra." "WalletECNewUXErrorMessageForCashback": "No se ha podido aplicar la devolucin de dinero a la compra en este momento. Intntelo de nuevo ms tarde." "WalletECNewUXErrorMessageForCoupon": "La prueba de cupones no est disponible en este momento, pero todava puede probar los cupones manualmente." "WalletECNewUXErrorMessageForGiftCard": "No pudimos aplicar tu tarjeta regalo a esta compra. $1" "WalletECNewUXErrorMessageForGiftCardLink": "Ver el estado de la tarjeta regalo" "WalletECNewUXForNoSuccessMessage": "Lo sentimos, no podemos ayudarle en este momento" "WalletECNewUXForNoWorkingCoupon": "No encontramos ningn cupn de trabajo" "WalletECNewUXMultiErrorMessageForAutofill": "Autorrellenar" "WalletECNewUXMultiErrorMessageForCashback": "efectivo devuelto" "WalletECNewUXMultiErrorMessageForCoupon": "cupones" "WalletECNewUXMultiErrorMessageForiftCard": "Tarjeta de regalo" "WalletECNewUXPartialSuccessMessageForAutofill": "Se han rellenado algunos de los detalles. Introducir la informacin restante para completar la compra" "WalletECNewUXSSuccessMessageForCouponAndGiftCard": "Ya ha guardado $1 con el mejor cupn y la tarjeta regalo" "WalletECNewUXSuccessMessageForAutofill": "Se han rellenado los detalles de la finalizacin de la compra" "WalletECNewUXSuccessMessageForCashback": "Obtendr hasta $1 en efectivo de devolucin de $2" "WalletECNewUXSuccessMessageForCoupon": "Ya ha guardado $1 con el mejor cup "WalletECNewUXSuccessMessageForGiftCard": "Ya ha guardado $1 con la tarjeta regalo", "WalletECSimplifyAutofillSubTitle": "Activar para habilitar autorrellenar", "WalletECSimplifyAutofillTitle": "Autorellenar detalles de finalizacin de la compra", "WalletECUXSimplifyCtaDescriptionSaving": "aplicar descuento", "walletBNPLSmallCardBottomMessagePayInFour": "$1 tambin ofrece pagos mensuales con intereses.", "walletBNPLSmallCardBottomMessageZip": "Zip tambin ofrece pagos mensuales con intereses.", "walletBNPLSmallCardFooterMessage": "Microsoft no le cobra ni recibe pagos de estos proveedores.", "walletBNPLSmallCardTitle": "La compra se dividir en 4 plazos", "walletBNPLSmallCardTitleBothFinancedAndPayInFour": "La compra se puede dividir en 4 entregas.", "walletChangeYourSettings": "cambiar la configuraci "walletDrawerFormPageMicroFeedbackPrompt": "s satisfecho con Cartera?" "walletDrawerGiftCardAuofillMultipleFailureTitle": "Aplica automticamente tu tarjeta regalo a este pedido. Comprueba el nmero de la tarjeta regalo en tu correo electrnico y Escrbelo manualmente para usarlo." "walletDrawerGiftCardAutofillFailureTitle": "No pudimos aplicar automticamente tu tarjeta regalo a este pedido. Comprueba el nmero de la tarjeta regalo en tu correo electrnico y escrbelo manualmente para usarlo." "walletDrawerGiftCardRedeemFailureTitle": "No pudimos canjear tus puntos de Rewards como tarjeta regalo. Puedes continuar con el pedido o volver a intentar la transaccis tarde." "walletDrawerGiftCardRedeemMultipleFailureTitle": "Canjea tus puntos de Rewards como tarjeta regalo." "walletECAllFailureMessageBottom": "No te preocupes, todava puedes continuar con la transaccin." "walletECAllFailureTitle": "Las siguientes caractersticas no estn disponibles en este momento:" "walletECApplyCashBackTitle": "Dinero devuelto" "walletECApplyCashCackTitle": "Obtendr hasta $1 en efectivo devuelto." "walletECApplySavingTitle": "Ahorrar $1 y obtendr hasta $2 en efectivo." "walletECAutoApplyApplyingBestCouponsNew": "Aplicando el mejor cupn que encontramos..." "walletECAutoApplyFailureTitle": "Las pruebas de cupones no estn disponibles en este momento, pero todava puede probar los cupones manualmente." "walletECAutoApplyFeature": "Cupones de prueba" "walletECAutoApplyTryingCoupons": "Intentando $1..." "walletECAutofillErrorMessage": "Detalles de Autorrellenar" "walletECAutofillPaymentOnlySingleErrorMessage": "Autorrellenar no pudo completar todos los detalles. Introdcelos manualmente para continuar con la transaccin." "walletECAutofillPaymentOnlySuccessMessage": "Hemos rellenado automticamente sus datos de pago para finalizar la compra rpidamente." "walletECAvailableRewardsPoints": "$1 puntos disponibles" "walletECCancelCouponButton": "Omitir cupones" "walletECCancelCouponFooter": "Un 45% de los usuarios ahorraron con cupones" "walletECCancelCouponStatus": "Cancelar cupones que se estn aplicando" "walletECCashBackAndCouponTitle": "Efectivo devuelto y cupones" "walletECCashBackDisplayValue": "Hasta $1" "walletECCashBackEnableErrorMessage": "No se pudo aplicar el reembolso a la compra en este momento. Intntalo de nuevo ms tarde." "walletECCashBackEnableSubErrorMessage": "Activar reembolso" "walletECCashBackInfo": "Recibir actualizaciones por correo electrnico y har un seguimiento del efectivo devuelto por $1." "walletECCashBackOptionText": "Obtener una devolucin de dinero" "walletECCashBackUpto": "Hasta $1" "walletECCashbackActivateFailedLabel": "No pudimos activar la devolucin de efectivo para esta compra. Intntalo de nuevo ms tarde." "walletECCashbackActivateLabel": "Activar reembolso" "walletECCashbackEnrollDisclaimer": "Iniciars sesin en Microsoft Edge, que realizar una copia de seguridad de sus datos de navegacin y te permitir ver tus favoritos, contraseas, historial y ms en todos sus dispositivos. Tambin te unirs y recibirs correos electrnicos de alrededor de $1, que incluyen ofertas sobre productos de socios. $2 | $3" "walletECCashbackLinkLabel": "Ver detalles de la oferta en $1" "walletECCashbackPrivacyLinkLabel": "Privacidad y cookies" "walletECCashbackSigninLabel": "nete ahora y activa la devolucin de dinero" "walletECCashbackStatus": "Reembolso activado" "walletECCashbackTermsLinkLabel": "Trminos" "walletECContinueSavingsAndFillDetailsButtonLabel": "Aplicar descuento y continuar" "walletECContinueSavingsAndFillDetailsLabel": "Al continuar, activaremos el programa de reembolsos, aplicaremos cupones automticamente y rellenaremos la informacin de envo y facturacin." "walletECContinueSavingsAndFillDetailsLabelBNPL": "Al continuar, activaremos el programa de reembolsos, aplicaremos cupones y rellenaremos automticamente el envo y le llevaremos a $1" "walletECContinueSavingsAndFillDetailsNoCouponLabel": "Al continuar, activaremos el programa de reembolsos y rellenaremos la informacin de envo y facturacin." "walletECContinueSavingsAndFillDetailsNoCouponLabelBNPL": "Al continuar, activaremos el programa de reembolsos y rellenaremos automticamente el envo y le llevaremos a $1" "walletECContinueSavingsButtonLabel": "Aplicar descuento" "walletECContinueSavingsLabel": "Al continuar, activaremos el programa de reembolsos y aplicaremos cupones automticamente." "walletECContinueSavingsNoCouponLabel": "Si contina, activaremos el programa de reembolsos." "walletECCouponAverageSaving": "De media, se ha ahorrado $1" "walletECCouponOptionText": "Usar cup "walletECCouponsCookieDisclaimer": "Permito colocar $1 en mi dispositivo para ayudar a facturar con el proveedor de cupones segn $2", "walletECCouponsCookieDisclaimerPrivacyLinkLabel": "Declaracin de privacidad de Microsoft", "walletECEnjoyMessage": "Disfrute del resto de su recorrido de compra.", "walletECFillDetailsButtonLabelUXSimplify": "Rellenar detalles", "walletECFreBannerContent": "Encuentre las mejores ofertas con cupones y reembolsos todo antes de pagar.", "walletECFreBannerTitle": "Ahorre dinero y tiempo con Wallet en Microsoft Edge", "walletECGetCashbackLabel": "Puede conseguir hasta $1 de reembolso en $2.", "walletECGiftCardTitle": "Tarjeta regalo", "walletECManagePersonalInfo": "Administrar la informacin personal", "walletECMaskedCardDetailFetching": "Escriba su CVC para continuar", "walletECMaskedFetchErrorMessage": "Intntelo de nuevo y escriba su CVC cuando se le solicite. O bien seleccione otro mtodo de pago para continuar.", "walletECNewCtaDescriptionTemplateFive": "Si contina se le pedir $1 $2 $3 $4 y $5.", "walletECNewCtaDescriptionTemplateFour": "Si contina se le pedir $1 $2 $3 y $4.", "walletECNewCtaDescriptionTemplateOne": "Si contina se le pedir $1.", "walletECNewCtaDescriptionTemplateThree": "Si contina se le pedir $1 $2 y $3.", "walletECNewCtaDescriptionTemplateTwo": "Si contina se le pedir $1 y $2.", "walletECNewShippingAddressTitle": "Detalles del env "walletECNewUXErrorMessageTemplateFive": "Los $1, $2, $3, $4 y $5 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateFour": "Los $1, $2, $3 y $4 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateThree": "Los $1, $2 y $3 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateTwo": "Los $1 y $2 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNoSavedAddress": "No hay direccin guardada" "walletECNoSavedName": "No hay nombre guardado" "walletECRebatesCouponsSelectorDescription": "Le hemos aplicado los mejores descuentos y hemos encontrado que solo puede utilizar uno para esta compra. Seleccione una de las opciones siguientes para continuar." "walletECRebatesCouponsSelectorTitle": "Elija uno para continuar" "walletECReturnToCheckoutButtonAria": "Cerrar el panel y volver a la pgina de finalizacin de la compra" "walletECRewardsDonotRedeemOptionPoints": "No canjear puntos de recompensa" "walletECRewardsNoGiftCardSelected": "No hay ninguna tarjeta regalo seleccionada" "walletECRewardsPointsAndAvailableRewardsPoints": "$1/$2 puntos" "walletECRewardsRedeemOptionPoints": "$1 puntos" "walletECRewardsRedeemOptionTitle": "Canjear tarjeta regalo de $1" "walletECRewardsTitle": "tarjeta regalo Microsoft Rewards" "walletECSavingsButtonLabelUXSimplify": "Aplicar los descuentos y rellenar los detalles" "walletECSavingsDisableMessage": "$1 para activar el reembolso y aplicar cupones automticamente. Esto puede ahorrarle tiempo y dinero cuando compre en Edge." "walletECShoppingInfo": "Est usando el efectivo devuelto y cupones de compra de Microsoft." "walletECShoppingInfoForCoupon": "y cupones" "walletECShoppingInfoNew": "Est usando la devolucin de dinero de Microsoft$1." "walletECSkipCouponProgressStatus": "Omitiendo cupones "walletECThirdPartyCookies": "Cookies de terceros", "walletECTokenizationCardDetailFetching": "Estamos conectando con su banco para generar los detalles de la tarjeta para esta transaccin. Esto puede llevar unos segundos.", "walletECTokenizationFetchErrorMessage": "No se pueden generar los detalles de la tarjeta virtual. Vuelva a intentarlo o elija otra tarjeta.", "walletECUXAffirmDescription": "Dividir pagos en 8 semanas", "walletECUXAffirmDescriptionFinanced": "Compre ahora. Pague con el tiempo con Affirm.", "walletECUXBNPLDropdownTitle": "Pagar a lo largo del tiempo", "walletECUXCardKlarnaDescription": "Sin cuotas de inters pueden aplicarse recargo por demora", "walletECUXKlarnaDescription": "Compre ahora. Pague con el tiempo con Klarna.", "walletECUXManagePaymentButtonTitle": "Administrar mtodos de pago", "walletECUXNewAddressDropdownLabel": "Seleccionar direccin de env "walletECUXNewOnlyCardDropdownTitle": "Pagar con tarjeta" "walletECUXNewPaymentDropdownLabel": "Seleccionar mtodo de pago" "walletECUXNewPaymentDropdownTitle": "Pagar con tarjeta o pagar a lo largo del tiempo" "walletECUXSBillingTheSameWithShipAddress": "La direccin de facturacin es la misma que la direccin de env "walletECUXSInEligibleCardLogoContent": "Este sitio web no admite tarjeta virtual", "walletECUXSTokenCardLogoContent": "Nmero de tarjeta virtual $1 activado para proteger la informacin de pago", "walletECUXSmallCardAffirmDescription": "Sin recargo por demora sin intereses", "walletECUXSmallCardZipDescription": "Sin impacto en la puntuacin de crdito pueden aplicarse recargo por demora", "walletECUXZipDescription": "Dividir pagos en 6 semanas", "walletECUXsimplifyBGAANegativeContent": "Cartera prob todos los cupones pero no encontr ningn ahorro", "walletECUXsimplifyBGAANegativeTitle": "Tiene el mejor precio", "walletECUXsimplifyBGAAPostiveCouponContent": "Cartera ha probado todos los cupones disponibles", "walletECUXsimplifyBGAAPostiveTitle": "Ests ahorrando $1", "walletECUXsimplifyCashbackEnrollText": "Obtener hasta $1 con $2", "walletECUXsimplifyCashbackValue": "Hasta $1", "walletECUXsimplifyMutipleCoupon": "$1 cupones", "walletECUXsimplifyOneCoupon": "1 cup "walletECUXsimplifySavingTitle": "Aplicar descuento" "walletECUXsimplifyShoppingToggleOffCashback": "Activar Reembolso de Microsoft" "walletECUXsimplifyShoppingToggleOffCashbackAndCoupon": "Activar MicrosoftCashback y aplicar cupones automticamente" "walletECUXsimplifyShoppingToggleOffContentLabel": "$1 para ahorrar tiempo y dinero al comprar online." "walletECUXsimplifyShoppingToggleOffCoupon": "Aplicar cupones automticamente" "walletECUXsimplifyShoppingToggleOffTitle": "Activar las compras en MicrosoftEdge" "walletECUXsimplifyStandardCouponContent": "Ahorro medio: $1 en $2" "walletECUXsimplifyStandardCouponContentForBestOffer": "Cartera encontrar la mejor oferta para ti" "walletECUXsimplifyStandardCouponTitle": "Se probar $1" "walletSelectString": "$1 o $2"" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Declarao de Privacidade da Microsoft", "aboutTermsOfUseLinkText": "Termos de Utilizao do Microsoft Edge", "affirmDescriptionText": "Compre agora pague de forma faseada com o Affirm. $1", "affirmDisclaimerLinkText": "Contacte a Affirm", "affirmDisclaimerText": "O Carto Affirm um carto virtual de utilizao limitada financiado pelo Cross River Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ou pela Affirm Loan Services LLC dependendo dos termos do seu contrato de emprstimo. emitido pelo Sutton Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ao abrigo da licena da Visa U.S.A. Inc. O Carto Affirm emitido pela Marqeta. Se tiver alguma questo $1.", "affirmEstimatedFeesText": "No aplicadas taxas por atrasos", "affirmLogoDesc": "Compre agora pague de forma faseada com a Affirm", "affirmPolicy": "Ao continuar concorda com $1 e reconhece que o seu montante total de compra juntamente com o local onde faz compras ser partilhado com a Affirm de acordo com $2. Se tiver sido recentemente aprovado para uma transao pela Affirm podem aplicar-se os termos de pagamento com essa aprovao.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Inicie sesso na sua aplicao de banca online para receber um cdigo de verificao.", "challengeDescriptionCustomerService": "Ligue para o seu banco no $1 para receber um cdigo de verificao.", "challengeDescriptionEmail": "O seu banco est a enviar-lhe um cdigo de verificao para o seu endereo de e-mail $1.", "challengeDescriptionOnlineBanking": "Introduza abaixo o cdigo que recebeu do seu banco.", "challengeDescriptionOutboundCall": "O seu banco ir ligar para o seu nmero de telemvel $1 com um cdigo de verificao.", "challengeDescriptionSMS": "O seu banco est a enviar-lhe um cdigo de verificao para o nmero de telemvel $1.", "close": "Fechar", "commonSubtitle": "Veja se elegvel para pagamentos faseados", "dismiss": "Dispensar", "feedbackOptionAutofillDontWork": "O preenchimento automtico no funcionou", "feedbackOptionOthers": "Outro", "feedbackOptionTookTooMuchTime": "Demorou demasiado tempo", "klarnaDescriptionText": "Faa as suas compras agora. Pague ao longo do tempo com a Klarna. $1", "klarnaDisclaimerText": "O Carto Comercial Klarna Visa emitido pelo Sutton Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ao abrigo da licena da Visa U.S.A Inc. O Carto Klarna tem tecnologia da Marqeta. Apoio a Clientes: $1", "klarnaEstimatedFeesText": "Podem aplicar-se taxas do servio Klarna de atraso", "klarnaFeeTermLinkText": "Servio \"Pague Depois\" da Klarna em $1", "klarnaLogoDesc": "Poupe dinheiro com a Klarna.", "klarnaPolicy": "Ao continuar concorda com $1 e reconhece que o seu montante total de compra juntamente com o local onde faz compras ser partilhado com a Klarna de acordo com $2. Se tiver sido recentemente aprovado para uma transao pela Klarna podem aplicar-se os termos de pagamento com essa aprovao.", "learnMore": "Saber mais", "manageYourPaymentMethodsLinkText": "Gerir os seus mtodos de pagamento", "msPayAddCardAgreement": "Ao continuar concorda com $1 $2 e $3 relativamente forma como os seus dados so tratados.", "nextButtonAriaLabel": "Ir para a pgina seguinte", "paginationButtonAriaLabel": "Ir para a pgina $1", "paymentServiceTermsLinkText": "Termos do Servio de Pagamento", "previousButtonAriaLabel": "Ir para a pgina anterior", "textOfChangeButton": "Alterar", "textOfCreateButton": "Criar", "tokenizationEnroll": "Inscrever-se", "tokenizationEnrollConfirmDialogTitle": "Pague em segurana com um carto virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configure um carto virtual e ganhe 20 pontos do Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "O emissor do seu carto pode enviar um cdigo de verificao ou pedir o cdigo de segurana do carto para verificar se se trata de si.", "tokenizationEnrollConfirmModalDescription": "Um carto virtual oculta os detalhes do seu carto a comerciantes quando fizer compras online. Se algum deles tiver uma falha de segurana de dados os seus detalhes permanecero protegidos. $1", "tokenizationTerms": "Ao continuar concorda com os $1.", "tokenizeCardBack": "Voltar", "tokenizeCardChallengeMethodAPPToAPP": "Aplicao de servio bancrio mvel", "tokenizeCardChallengeMethodCustomerService": "Suporte ao cliente do banco", "tokenizeCardChallengeMethodEmail": "E-mail", "tokenizeCardChallengeMethodOnlineBanking": "Conta bancria", "tokenizeCardChallengeMethodOutboundCall": "Chamada telefnica", "tokenizeCardChallengeMethodSMS": "Mensagem de texto", "tokenizeCardCvvInvalidError": "Verifique o seu cdigo de segurana e tente novamente.", "tokenizeCardEnterCode": "Introduzir cdigo", "tokenizeCardEnterCodeStepTitle": "Vamos efetuar a verifica "tokenizeCardEnterCvvStepDescription": "O seu banco exige que verifique o cdigo de segurana CVV associado ao seu carto $1 que termina em $2." "tokenizeCardErrorStepTitle": "Ocorreu um erro" "tokenizeCardFetchCodeError": "O emissor do seu carto teve um problema ao enviar o cdigo. Pea outro cdigo ou utilize um mtodo de verificao diferente." "tokenizeCardFetchCodeErrorCustomerService": "O emissor do seu carto teve um problema ao gerar o cdigo. Experimente um mtodo de verificao diferente ou tente novamente mais tarde." "tokenizeCardGeneralError": "O emissor do seu carto est a ter problemas neste momento. Tente novamente mais tarde." "tokenizeCardLoadingTitle": "A contactar o seu banco "tokenizeCardNext": "Seguinte", "tokenizeCardResendCode": "Reenviar o cdigo", "tokenizeCardSelectMethodDescription": "Escolha um dos seguintes mtodos de verificao:", "tokenizeCardSelectMethodStepTitle": "Vamos efetuar a verifica "tokenizeCardSendingCode": "Cdigo enviado!" "tokenizeCardTryAgain": "Tentar novamente" "tokenizeCardValidationError": "O emissor do seu carto consegue efetuar a verificao. Tente novamente em breve." "tokenizeCardVerify": "Verificar" "tokenizeCardVerifyWithAnotherMethod": "Verificar com outro mtodo" "tokenizeCardVerifying": "A verificar" "walletCommonAccountCount": "$1 contas" "walletDrawerAutoFillErrorMessage": "No conseguimos preencher automaticamente as informaes do seu carto a partir do $1. Insira manualmente as informaes do seu carto $1 durante a compra." "walletDrawerAutoFillMessage": "Preenchemos automaticamente as informaes do seu carto a partir de $1." "walletDrawerAutoFillMessageWithBillingAddress": "Os seus detalhes de pagamento de $1 foram preenchidos. Caso no tenha, clique nos detalhes do carto e do endereo abaixo para copiar." "walletDrawerAutoFillMessageWithoutBillingAddress": "Os seus detalhes de pagamento de $1 foram preenchidos. Caso no tenha, clique nos detalhes do carto abaixo para copiar. Para concluir esta compra, preencha o seu endereo de faturao." "walletDrawerCvcLabel": "CVC" "walletDrawerExpirationLabel": "Expira "walletDrawerLabelCopyCardNumber": "Copiar nmero do cart "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nome e endere "walletDrawerLabelShowCardNumber": "Mostrar nmero do cart "walletDrawerLabelShowCvc": "Mostrar CVC" "walletDrawerLabelShowExpirationDate": "Copiar data de expira "walletDrawerLinkErrorMessage": "No conseguimos associar a sua conta Microsoft a $1. Tente novamente mais tarde.", "walletDrawerNameAndAddressLabel": "O seu nome e endereo para fatura "walletDrawerPayWithVirtualCard": "Pague com o seu carto $1 $2" "walletDrawerSystemErrorHeader": "Ups" "walletDrawerVirtualCardNumberLabel": "Nmero do carto virtual" "walletFeedbackThankYouText": "Obrigado pelo seu feedback. Ir ajudar-nos a melhorar a Carteira." "walletMicrofeedbackPrompt": "Est contente com a Carteira?" "walletSeeDetailsAriaLabel": "ver detalhes" "walletUXAddPaymentButtonTitle": "Adicionar novo cart "walletUXManagePaymentButtonTitle": "Gerir mtodos de pagamento", "walletUXSInEligibleCardLogoContent": "Este site no suporta cartes virtuais", "walletUXSTokenCardLogoContent": "Nmero de carto virtual $1 ativado para proteger as suas informaes de pagamento", "zipDescriptionText": "Compre agora pague durante seis semanas com o Zip. $1", "zipEstimatedFeesText": "Podem aplicar-se taxas de atraso", "zipFeeTermLinkText": "Termos de Servio do Zip", "zipLogoDesc": "Zip compre agora pague depois", "zipPolicy": "Ao continuar concorda com os nossos $1 e reconhece que o seu valor total de compra ser partilhado com a Zip de acordo com $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Poltica de Privacidade da Microsoft", "aboutTermsOfUseLinkText": "Termos de Uso do Microsoft Edge", "affirmDescriptionText": "Compre agora pague ao longo do tempo com Affirm. $1", "affirmDisclaimerLinkText": "Contactar a Affirm", "affirmDisclaimerText": "O Carto Afirmativo um carto virtual de uso limitado e financiamento pelo Cross River Bank membro da FDIC ou Affirm Loan Services empresa de responsabilidade limitada dependendo dos termos do seu contrato de emprstimo e emitido por Mila Bank membro da FDIC de acordo com a licena da Visa U.S.A. Inc. O Carto da Affirm emitido pela Marqeta. $1 se voc tiver alguma dvida.", "affirmEstimatedFeesText": "No se aplicam tarifas atrasadas", "affirmLogoDesc": "Compre agora pague a longo prazo com a Affirm", "affirmPolicy": "Ao continuar voc concorda com $1 e reconhece que o valor total da compra junto com o local em que voc compra ser compartilhado com a Affirm de acordo com $2. Se voc tiver sido aprovado recentemente pela Affirm para uma transao os termos de pagamento dessa aprovao podero ser aplicados.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Entre em seu aplicativo online do banco para receber um cdigo de verificao.", "challengeDescriptionCustomerService": "Ligue para seu banco no $1 para receber um cdigo de verificao.", "challengeDescriptionEmail": "Seu banco est lhe enviando um cdigo de verificao para seu endereo de email $1.", "challengeDescriptionOnlineBanking": "Insira abaixo o cdigo que voc recebeu de seu banco.", "challengeDescriptionOutboundCall": "Seu banco ligar para seu nmero de celular $1 com um cdigo de verificao.", "challengeDescriptionSMS": "Seu banco est lhe enviando um cdigo de verificao para seu nmero do telefone celular $1.", "close": "Fechar", "commonSubtitle": "Confira se est qualificado para pagamento a longo prazo", "dismiss": "Ignorar", "feedbackOptionAutofillDontWork": "O preenchimento automtico no funcionou", "feedbackOptionOthers": "Outros", "feedbackOptionTookTooMuchTime": "Demorou muito tempo", "klarnaDescriptionText": "Compre agora. Pague depois com o Klarna. $1", "klarnaDisclaimerText": "O Carto Comercial Visa Klarna emitido pelo Sutton Bank membro da FDIC de acordo com uma licena da Visa U.S.A Inc. O Carto Klarna da plataforma Marqeta. Servio de Atendimento ao Cliente $1", "klarnaEstimatedFeesText": "Servio Klarna e taxas atrasadas podem ser aplicadas", "klarnaFeeTermLinkText": "Pagar mais tarde em $1 do Klarna", "klarnaLogoDesc": "Economize dinheiro com a Klarna.", "klarnaPolicy": "Ao continuar voc concorda com $1 e reconhece que o valor total da compra junto com o local em que voc compra ser compartilhado com a Klarna de acordo com $2. Se voc tiver sido aprovado recentemente pela Klarna para uma transao os termos de pagamento dessa aprovao podero ser aplicados.", "learnMore": "Saiba mais", "manageYourPaymentMethodsLinkText": "Gerenciar suas formas de pagamento", "msPayAddCardAgreement": "Ao continuar voc concorda com os $1 $2 e $3 sobre como seus dados so tratados.", "nextButtonAriaLabel": "Ir para a prxima pgina", "paginationButtonAriaLabel": "Ir para a pgina $1", "paymentServiceTermsLinkText": "Termos e Condies de Servio de Pagamento", "previousButtonAriaLabel": "Ir para a pgina anterior", "textOfChangeButton": "Alterar", "textOfCreateButton": "Criar", "tokenizationEnroll": "Registrar", "tokenizationEnrollConfirmDialogTitle": "Pague de forma segura com um carto virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configurar um carto virtual e ganhar 20 pontos do Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "O emissor do seu carto pode enviar um cdigo de verificao ou solicitar o cdigo de segurana do carto para verificar se voc "tokenizationEnrollConfirmModalDescription": "Um carto virtual esconde os detalhes do seu carto dos comerciantes quando voc faz compras online. Se algum deles sofrer uma violao de dados, seus dados permanecero protegidos. $1" "tokenizationTerms": "Ao continuar, voc concorda com $1." "tokenizeCardBack": "Voltar" "tokenizeCardChallengeMethodAPPToAPP": "Aplicativo de dispositivo mvel do banco" "tokenizeCardChallengeMethodCustomerService": "Servio de atendimento ao cliente do banco" "tokenizeCardChallengeMethodEmail": "Email" "tokenizeCardChallengeMethodOnlineBanking": "Conta bancria" "tokenizeCardChallengeMethodOutboundCall": "Chamada telefnica" "tokenizeCardChallengeMethodSMS": "Mensagem de texto" "tokenizeCardCvvInvalidError": "Verifique seu cdigo de segurana e tente novamente." "tokenizeCardEnterCode": "Inserir cdigo" "tokenizeCardEnterCodeStepTitle": "Vamos fazer sua verifica "tokenizeCardEnterCvvStepDescription": "Seu banco exige que voc verifique o cdigo de segurana CVV associado ao seu $1 que termina em $2.", "tokenizeCardErrorStepTitle": "Algo deu errado", "tokenizeCardFetchCodeError": "O emissor do carto teve um problema ao enviar o cdigo. Solicite outro cdigo ou use um mtodo de verificao diferente.", "tokenizeCardFetchCodeErrorCustomerService": "O emissor do carto teve um problema ao gerar o cdigo. Tente um mtodo de verificao diferente ou tente novamente mais tarde.", "tokenizeCardGeneralError": "O emissor de seu carto est tendo problemas no momento. Tente novamente mais tarde.", "tokenizeCardLoadingTitle": "Contatando seu banco...", "tokenizeCardNext": "Avanar", "tokenizeCardResendCode": "Reenviar cdigo", "tokenizeCardSelectMethodDescription": "Escolha um dos seguintes mtodos de verificao:", "tokenizeCardSelectMethodStepTitle": "Vamos fazer sua verifica "tokenizeCardSendingCode": "Cdigo enviado!" "tokenizeCardTryAgain": "Tente novamente" "tokenizeCardValidationError": "O emissor de seu carto pode fazer a verificao. Tente novamente em breve." "tokenizeCardVerify": "Verificar" "tokenizeCardVerifyWithAnotherMethod": "Verificar com outro mtodo" "tokenizeCardVerifying": "Verificando" "walletCommonAccountCount": "$1 contas" "walletDrawerAutoFillErrorMessage": "N possvel preencher automaticamente as informaes do carto a partir de $1. Insira manualmente as informaes do carto de $1 durante a finalizao da compra." "walletDrawerAutoFillMessage": "Preenchemos automaticamente as informaes do seu carto a partir de $1." "walletDrawerAutoFillMessageWithBillingAddress": "Seus detalhes de pagamento de $1 foram preenchidos. Caso contrrio, clique no carto e nos detalhes do endereo abaixo para copiar." "walletDrawerAutoFillMessageWithoutBillingAddress": "Seus detalhes de pagamento de $1 foram preenchidos. Caso contrrio, clique nos detalhes do carto abaixo para copiar. Para concluir esta compra, preencha seu endereo de cobrana residencial." "walletDrawerCvcLabel": "CVC" "walletDrawerExpirationLabel": "Expira "walletDrawerLabelCopyCardNumber": "Copiar nmero do cart "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nome e endere "walletDrawerLabelShowCardNumber": "Mostrar nmero do cart "walletDrawerLabelShowCvc": "Mostrar CVC" "walletDrawerLabelShowExpirationDate": "Copiar data de validade" "walletDrawerLinkErrorMessage": "N possvel vincular sua conta Microsoft a $1. Tente novamente mais tarde." "walletDrawerNameAndAddressLabel": "Seu nome e endereo para cobran "walletDrawerPayWithVirtualCard": "Pague com seu carto $1 $2", "walletDrawerSystemErrorHeader": "Ah n "walletDrawerVirtualCardNumberLabel": "Nmero do carto virtual" "walletFeedbackThankYouText": "Obrigado por seus comentrios. Isso nos ajudar a melhorar a velocidade da Carteira." "walletMicrofeedbackPrompt": "Satisfeito com a Carteira?" "walletSeeDetailsAriaLabel": "ver detalhes" "walletUXAddPaymentButtonTitle": "Adicionar novo cart "walletUXManagePaymentButtonTitle": "Gerenciar formas de pagamento", "walletUXSInEligibleCardLogoContent": "Este site no suporta carto virtual", "walletUXSTokenCardLogoContent": "Nmero do carto virtual $1 ativado para proteger suas informaes de pagamento", "zipDescriptionText": "Compre agora pague em 6 semanas com Zip. $1", "zipEstimatedFeesText": "Taxas atrasadas podem ser aplicadas", "zipFeeTermLinkText": "Termos de Servio do Zip", "zipLogoDesc": "Zip comprar agora pagar depois", "zipPolicy": "Ao continuar voc concorda com nossos $1 e reconhece que o valor total da compra ser compartilhado com o Zip de acordo com $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Declaracin de privacidad de Microsoft", "aboutTermsOfUseLinkText": "Trminos de uso de Microsoft Edge", "affirmDescriptionText": "Compra ahora y paga despus con Affirm. $1", "affirmDisclaimerLinkText": "Ponerme en contacto con Affirm", "affirmDisclaimerText": "La tarjeta Affirm es una tarjeta virtual de uso limitado con fondos de Cross River Bank FDIC o Affirm Loan Services LLC en funcin de los trminos del contrato de prstamo y emitida por Sutton Bank banco miembro de FDIC en virtud de una licencia emitida por VisaU.S.AInc. La tarjeta Affirm cuenta con tecnologa de Marqeta. $1 si tienes alguna pregunta.", "affirmEstimatedFeesText": "No se aplican cargos con retraso", "affirmLogoDesc": "Compra ahora y paga despus con Affirm", "affirmPolicy": "Al continuar acepta $1 y reconoce que el importe total de la compra junto con el lugar en el que compra se compartirn con La autorizacin de acuerdo con $2. Si ha sido aprobado recientemente para una transaccin por Parte de la Funcin pueden aplicarse los trminos de pago con esa aprobacin.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Inicia sesin en tu aplicacin de banca en lnea para recibir un cdigo de verificacin.", "challengeDescriptionCustomerService": "Llama a tu banco al $1 para recibir un cdigo de verificacin.", "challengeDescriptionEmail": "Tu banco te est enviando un cdigo de verificacin a tu direccin de correo electrnico $1.", "challengeDescriptionOnlineBanking": "Introduce a continuacin el cdigo que recibiste de tu banco.", "challengeDescriptionOutboundCall": "Tu banco llamar a tu nmero de telfono mvil $1 con un cdigo de verificacin.", "challengeDescriptionSMS": "Tu banco te est enviando un cdigo de verificacin a tu nmero de telfono mvil $1.", "close": "Cerrar", "commonSubtitle": "Comprueba si cumples los requisitos para pagar despu "dismiss": "Descartar" "feedbackOptionAutofillDontWork": "Error al autorrellenar" "feedbackOptionOthers": "Otro" "feedbackOptionTookTooMuchTime": "Se tard demasiado tiempo" "klarnaDescriptionText": "Compra ahora. Paga despus con Klarna. $1" "klarnaDisclaimerText": "La tarjeta Klarna Visa Commercial Card es emitida por Sutton Bank, banco miembro de la Corporacin Federal de Seguro de Depsitos (FDIC), en virtud de una licencia emitida por VisaU.S.AInc. La tarjeta Klarna cuenta con tecnologa de Marqeta. Atencin al cliente $1" "klarnaEstimatedFeesText": "Pueden aplicarse cargos por servicio y demora de Klarna" "klarnaFeeTermLinkText": "\"Paga despus\" de Klarna en $1" "klarnaLogoDesc": "Ahorra dinero con Klarna." "klarnaPolicy": "Al continuar, acepta $1 y reconoce que el importe total de la compra junto con el lugar donde compre se compartir con Klarna, de acuerdo con $2. Si ha sido aprobado recientemente para una transaccin por Klarna, pueden aplicarse los trminos de pago con esa aprobacin." "learnMore": "Obtener ms informaci "manageYourPaymentMethodsLinkText": "Administrar los mtodos de pago", "msPayAddCardAgreement": "Al continuar aceptas $1 $2 y $3 relativos a cmo se administran sus datos.", "nextButtonAriaLabel": "Ir a la pgina siguiente", "paginationButtonAriaLabel": "Ir a la pgina $1", "paymentServiceTermsLinkText": "Trminos del servicio de pago", "previousButtonAriaLabel": "Ir a la pgina anterior", "textOfChangeButton": "Cambiar", "textOfCreateButton": "Crear", "tokenizationEnroll": "Inscribirse", "tokenizationEnrollConfirmDialogTitle": "Paga de forma segura con una tarjeta virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configurar una tarjeta virtual y ganar 20 puntos de Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "El emisor de la tarjeta puede enviar un cdigo de verificacin o solicitar el cdigo de seguridad de la tarjeta para comprobar que eres t "tokenizationEnrollConfirmModalDescription": "Una tarjeta virtual oculta los detalles de la tarjeta a los comerciantes cuando compras en lnea. Si alguno de ellos experimenta una vulneracin de datos, tus detalles permanecern protegidos. $1" "tokenizationTerms": "Al continuar, aceptas el $1." "tokenizeCardBack": "Atr "tokenizeCardChallengeMethodAPPToAPP": "Aplicacin de banca mvil", "tokenizeCardChallengeMethodCustomerService": "Servicio de atencin al cliente del banco", "tokenizeCardChallengeMethodEmail": "Correo electrnico", "tokenizeCardChallengeMethodOnlineBanking": "Cuenta bancaria", "tokenizeCardChallengeMethodOutboundCall": "Llamada telefnica", "tokenizeCardChallengeMethodSMS": "Mensaje de texto", "tokenizeCardCvvInvalidError": "Comprueba el cdigo de seguridad e intntalo de nuevo.", "tokenizeCardEnterCode": "Introducir cdigo", "tokenizeCardEnterCodeStepTitle": "Vamos a realizar la comprobaci "tokenizeCardEnterCvvStepDescription": "Tu banco requiere que compruebes el cdigo de seguridad CVV asociado a tu $1 que termina en $2." "tokenizeCardErrorStepTitle": "Hubo un problema" "tokenizeCardFetchCodeError": "El emisor de la tarjeta tuvo un problema para enviar el cdigo. Solicite otro cdigo o use otro mtodo de verificacin." "tokenizeCardFetchCodeErrorCustomerService": "El emisor de la tarjeta tuvo un problema al generar el cdigo. Pruebe con otro mtodo de verificacin o intntelo de nuevo ms tarde." "tokenizeCardGeneralError": "El emisor de la tarjeta tiene problemas en este momento. Vuelve a intentarlo ms tarde." "tokenizeCardLoadingTitle": "Contactando con tu banco..." "tokenizeCardNext": "Siguiente" "tokenizeCardResendCode": "Reenviar cdigo" "tokenizeCardSelectMethodDescription": "Elige uno de los mtodos de comprobacin siguientes:" "tokenizeCardSelectMethodStepTitle": "Vamos a realizar la comprobaci "tokenizeCardSendingCode": "Cdigo enviado", "tokenizeCardTryAgain": "Volver a intentarlo", "tokenizeCardValidationError": "El emisor de la tarjeta no pudo comprobarlo. Intntalo de nuevo en breve.", "tokenizeCardVerify": "Comprobar", "tokenizeCardVerifyWithAnotherMethod": "Comprobar con otro mtodo", "tokenizeCardVerifying": "Verificando", "walletCommonAccountCount": "$1 cuenta", "walletDrawerAutoFillErrorMessage": "No podemos rellenar automticamente la informacin de tu tarjeta desde $1. Escribe manualmente esta informacin de $1 durante la finalizacin de la compra.", "walletDrawerAutoFillMessage": "Hemos rellenado automticamente la informacin de la tarjeta desde $1.", "walletDrawerAutoFillMessageWithBillingAddress": "Se han rellenado los detalles de pago de $1. Si no es as haga clic en la tarjeta y los detalles de direccin siguientes para copiar.", "walletDrawerAutoFillMessageWithoutBillingAddress": "Se han rellenado los detalles de pago de $1. Si no es as haga clic en los detalles de la tarjeta a continuacin para copiar. Para completar esta compra rellene la direccin de facturacin de su hogar.", "walletDrawerCvcLabel": "CVC", "walletDrawerExpirationLabel": "Expiraci "walletDrawerLabelCopyCardNumber": "Copiar nmero de la tarjeta" "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nombre y direcci "walletDrawerLabelShowCardNumber": "Mostrar nmero de tarjeta", "walletDrawerLabelShowCvc": "Mostrar CVC", "walletDrawerLabelShowExpirationDate": "Copiar fecha de expiraci "walletDrawerLinkErrorMessage": "No podemos vincular tu cuenta Microsoft a $1. Vuelve a intentarlo ms tarde." "walletDrawerNameAndAddressLabel": "Tu nombre y direccin de facturaci "walletDrawerPayWithVirtualCard": "Pagar con tu tarjeta $1 $2", "walletDrawerSystemErrorHeader": "Vaya!", "walletDrawerVirtualCardNumberLabel": "Nmero de tarjeta virtual", "walletFeedbackThankYouText": "Gracias por los comentarios. Nos ayudar a mejorar Cartera.", "walletMicrofeedbackPrompt": "s satisfecho con Cartera?", "walletSeeDetailsAriaLabel": "ver detalles", "walletUXAddPaymentButtonTitle": "Agregar nueva tarjeta", "walletUXManagePaymentButtonTitle": "Administrar mtodos de pago", "walletUXSInEligibleCardLogoContent": "Este sitio web no admite tarjeta virtual", "walletUXSTokenCardLogoContent": "Nmero de tarjeta virtual $1 activado para proteger la informacin de pago", "zipDescriptionText": "Compra ahora paga en 6 semanas con Zip. $1", "zipEstimatedFeesText": "Pueden aplicarse cargos con retraso", "zipFeeTermLinkText": "Trminos del servicio de Zip", "zipLogoDesc": "Zip compra ahora paga despu "zipPolicy": "Al continuar, aceptas nuestros $1 y reconoces que el importe total de la compra se compartir con Zip, de acuerdo con $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""activateVirtualCardButtonText": "Ativar carto virtual", "featurePromotionActionLinkText": "Experimentar agora", "learnMoreLinkTextShort": "Saber mais", "membershipsDescription": "Mantenha tudo organizado e sob controlo.", "membershipsPromotionTitle": "Faa a gesto das suas associaes na Carteira", "msWalletNotificationCardExpired": "O seu carto expirou", "msWalletNotificationCardExpiring": "O seu carto expira em breve", "msWalletNotificationCardTokenizationEligibleDescription": "Os cartes virtuais so credenciais de pagamento de utilizanica que so geradas aleatoriamente sempre que faz uma compra online. Isto ajuda a garantir que o seu $1 est protegido.", "msWalletNotificationCardTokenizationEligibleHeader": "Proteja os detalhes do seu cart "msWalletNotificationCardTokenizationEligibleIntroduction": "Configure um carto virtual para tornar as compras online mais seguras e convenientes." "msWalletNotificationCardTokenizationEligibleIntroductionForRewards": "Configure um carto virtual para tornar as compras online mais seguras e ganhar 20 pontos do Microsoft Rewards." "msWalletNotificationCardTokenizationEligibleSetUpText": "Configurar para $1" "msWalletNotificationCardTokenizationEligibleTitle": "Proteja as suas compras com cartes virtuais" "msWalletNotificationCryptowalletJoinButton": "Configurar" "msWalletNotificationCryptowalletSignupDescription": "Explore a Web3 de forma segura com esta carteira sem depositrio" "msWalletNotificationCryptowalletSignupTitle": "Configurar a sua Carteira Criptogrfica" "msWalletNotificationDismissLabel": "Dispensar" "msWalletNotificationDismissPermanently": "Dispensar permanentemente" "msWalletNotificationDismissText": "No ver esta notificao novamente" "msWalletNotificationDonationSummaryLinkText": "Conferir" "msWalletNotificationDonationSummaryTitle": "Veja todo o seu resumo de donativos e n "msWalletNotificationFixLeakage": "Ver detalhes", "msWalletNotificationHotelReservationBody": "A sua data de reserva de $1 de $2 a $3 est a aproximar-se.", "msWalletNotificationHotelReservationTitle": "Alojamento futuro", "msWalletNotificationHotelReservationViewDetails": "Ver detalhes", "msWalletNotificationLeakageBody": "$1 das suas $2 palavras-passe foram divulgadas.", "msWalletNotificationLeakageTitle": "Divulgao de palavra-passe", "msWalletNotificationOrderStatusTitle": "Estado da encomenda atualizado", "msWalletNotificationPOMessage": "A sua oferta selecionada de $1 do Microsoft Cashback expira dentro de $2", "msWalletNotificationPOTitle": "Oferta a expirar em breve", "msWalletNotificationPasswordCompromiseBody": "Microsoft Edge detected that $1 of your passwords were found in a known online leak.", "msWalletNotificationPasswordCompromiseTitle": "Password compromise", "msWalletNotificationRebatesCashoutAction": "Transferir para Paypal", "msWalletNotificationRebatesCashoutAmountDescription": "Parabns tem $1 de reembolso. Levante com o PayPal.", "msWalletNotificationRebatesCashoutDescription": "Saiba mais sobre o programa de reembolso e o levantamento com o PayPal.", "msWalletNotificationRebatesCashoutTitle": "Est na hora de receber o seu reembolso!", "msWalletNotificationRoamCardAction": "Guardar o cart "msWalletNotificationRoamCardActionV2": "Guardar carto na conta Microsoft" "msWalletNotificationRoamCardHeader": "Guardar o carto na conta Microsoft" "msWalletNotificationRoamCardHeaderV2": "Pague mais rapidamente e a partir de diferentes dispositivos em compras futuras" "msWalletNotificationRoamCardHeaderV3": "Pague mais rapidamente a partir de qualquer dispositivo" "msWalletNotificationSnoozeLabel": "Suspender" "msWalletNotificationSnoozeText": "Notificao suspensa durante sete dias" "msWalletNotificationSnoozeText1": "Notificao suspensa durante $1 dias" "msWalletNotificationTrackOrderLink": "Monitorizar encomenda" "msWalletNotificationTrackOrderSubTitle": "A carteira ajuda a monitorizar a sua encomenda quando compra em determinados sites." "msWalletNotificationTrackOrderTitle": "Monitorizar a sua encomenda" "msWalletNotificationUpdateButton": "Atualizar agora" "msWalletNotificationUpdateButton1": "Atualizar ou remover cart "msWalletNotificationUpdateButton2": "Corrigir", "msWalletNotificationUpdateCardFailText": "A atualizao falhou. Tente novamente em $1", "msWalletNotificationUpdateExpText": "Edite as informaes do seu carto para continuar a utilizar o seu carto que termina em $1.", "msWalletNotificationUpdateExpTextV2MissingIssuer": "Atualize o seu carto com terminao em $1 para continuar a utiliz-lo.", "msWalletNotificationUpdatedCardText": "Carto atualizado com xito!", "msWalletNotificationViewDetailLink": "Ver detalhes", "passwordsDescription": "Desfrute da nova experincia de gesto na Carteira.", "passwordsPromotionTitle": "Gerir as suas palavras-passe na Carteira", "personalizedOffersCashBackDescription": "Ganhe $1 de reembolso com a $2.", "personalizedOffersNoThanksText": "No obrigado", "personalizedOffersOfferExpiresInText": "A oferta expira dentro de", "personalizedOffersViewOfferText": "Ver oferta", "rewardsPromotionActionLinkText": "Adicionar nova associa "rewardsPromotionDescription": "Ganhe at 20 pontos Rewards ao adicionar novas associa carteira" "rewardsPromotionTitle": "Adicione associaes para obter Microsoft Rewards" "walletTitle": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""activateVirtualCardButtonText": "Activar tarjeta virtual", "featurePromotionActionLinkText": "Probar ahora", "learnMoreLinkTextShort": "Obtener ms informaci "membershipsDescription": "Mantngase organizado y en control." "membershipsPromotionTitle": "Administra tus suscripciones en Cartera" "msWalletNotificationCardExpired": "Su tarjeta ha caducado" "msWalletNotificationCardExpiring": "Su tarjeta expirar pronto" "msWalletNotificationCardTokenizationEligibleDescription": "Las tarjetas virtuales son credenciales de pago de un solo uso que se generan aleatoriamente cada vez que se realiza una compra en lnea. Esto ayuda a garantizar que su tarjeta $1 est protegida." "msWalletNotificationCardTokenizationEligibleHeader": "Proteja los datos de sus tarjetas" "msWalletNotificationCardTokenizationEligibleIntroduction": "Configure una tarjeta virtual para que las compras en lnea sean ms seguras y mmodas." "msWalletNotificationCardTokenizationEligibleIntroductionForRewards": "Configure una tarjeta virtual para que sus compras en lnea sean ms seguras y gane 20 puntos de Microsoft Rewards." "msWalletNotificationCardTokenizationEligibleSetUpText": "Configurar por $1" "msWalletNotificationCardTokenizationEligibleTitle": "Proteger las compras con tarjetas virtuales" "msWalletNotificationCryptowalletJoinButton": "Configurar" "msWalletNotificationCryptowalletSignupDescription": "Explorar Web3 de forma segura con esta cartera que no es custodio" "msWalletNotificationCryptowalletSignupTitle": "Configure su Cartera criptogrfica" "msWalletNotificationDismissLabel": "Descartar" "msWalletNotificationDismissPermanently": "Descartar permanentemente" "msWalletNotificationDismissText": "No volvers a ver esta notificaci "msWalletNotificationDonationSummaryLinkText": "Comprubelo", "msWalletNotificationDonationSummaryTitle": "Ver todo el resumen de la entrega y mucho m "msWalletNotificationFixLeakage": "Ver detalles" "msWalletNotificationHotelReservationBody": "Tu fecha de reserva de $1 del $2 al $3 estxima." "msWalletNotificationHotelReservationTitle": "Prximo alojamiento" "msWalletNotificationHotelReservationViewDetails": "Ver detalles" "msWalletNotificationLeakageBody": "Se han filtrado $1 de sus $2 contraseas." "msWalletNotificationLeakageTitle": "Filtracin de contraseas" "msWalletNotificationOrderStatusTitle": "Estado del pedido actualizado" "msWalletNotificationPOMessage": "Tu oferta seleccionada de Microsoft Cashback de $1 expira en $2" "msWalletNotificationPOTitle": "La oferta expirar pronto" "msWalletNotificationPasswordCompromiseBody": "Microsoft Edge detected that $1 of your passwords were found in a known online leak." "msWalletNotificationPasswordCompromiseTitle": "Password compromise" "msWalletNotificationRebatesCashoutAction": "Transferir a PayPal" "msWalletNotificationRebatesCashoutAmountDescription": "Enhorabuena, tienes $1 en efectivo. Reembolso con PayPal." "msWalletNotificationRebatesCashoutDescription": "Ms informacin sobre el programa de devolucin de efectivo y el reembolso con PayPal." "msWalletNotificationRebatesCashoutTitle": "Es hora de cobrar!" "msWalletNotificationRoamCardAction": "Guardar la tarjeta" "msWalletNotificationRoamCardActionV2": "Guardar tarjeta en la cuenta de Microsoft" "msWalletNotificationRoamCardHeader": "Guardar la tarjeta en la cuenta de Microsoft" "msWalletNotificationRoamCardHeaderV2": "Pagar mpido y desde diferentes dispositivos en futuras compras" "msWalletNotificationRoamCardHeaderV3": "Pagar mpido desde cualquier dispositivo" "msWalletNotificationSnoozeLabel": "Posponer" "msWalletNotificationSnoozeText": "Notificacin pospuesta durante 7 das" "msWalletNotificationSnoozeText1": "Notificacin pospuesta durante $1 das" "msWalletNotificationTrackOrderLink": "Seguimiento de pedidos" "msWalletNotificationTrackOrderSubTitle": "La Cartera se ayuda a realizar un seguimiento de su pedido cuando compra en determinados sitios." "msWalletNotificationTrackOrderTitle": "Realizar un seguimiento del pedido" "msWalletNotificationUpdateButton": "Actualizar ahora" "msWalletNotificationUpdateButton1": "Actualizar o quitar tarjeta" "msWalletNotificationUpdateButton2": "Corregir" "msWalletNotificationUpdateCardFailText": "Error al actualizar. Intntalo de nuevo en $1" "msWalletNotificationUpdateExpText": "Edita la informacin de la tarjeta para seguir usando la tarjeta que termina en $1." "msWalletNotificationUpdateExpTextV2MissingIssuer": "Actualice la tarjeta que termina en $1 para seguir usndola." "msWalletNotificationUpdatedCardText": "La tarjeta se actualiz correctamente" "msWalletNotificationViewDetailLink": "Ver detalles" "passwordsDescription": "Probar la nueva experiencia de administracin en Cartera." "passwordsPromotionTitle": "Administrar las contraseas en Cartera" "personalizedOffersCashBackDescription": "Recupera $1 en efectivo con $2." "personalizedOffersNoThanksText": "No, gracias" "personalizedOffersOfferExpiresInText": "La oferta caduca en" "personalizedOffersViewOfferText": "Ver la oferta" "rewardsPromotionActionLinkText": "Agregar nueva suscripci "rewardsPromotionDescription": "Gane hasta 20 puntos de recompensa agregando nuevas suscripciones a la cartera", "rewardsPromotionTitle": "Agrega suscripciones para ganar Microsoft Rewards", "walletTitle": "Cartera"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalhes", "actionsAndUpcomingTitle": "Aes e futuras", "address": "Endereos", "all": "Tudo", "bookingId": "ID da Reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Cartas", "cashback": "Reembolso", "checkIn": "Check-in", "checkOut": "Check-out", "digitalIdMembershipAddMembership": "Adicionar nova", "digitalIdMembershipEmptySubtitle": "Armazenamos a sua associao para ajudar a preencher rapidamente as informaes quando reserva bilhetes de voo e fornecemos capacidades diversas para que consiga maximizar as suas poupanas em conformidade.", "digitalIdMembershipEmptyTitle": "Ainda no existe nenhuma associa "done": "Concludo" "earn": "Ganhe" "edit": "Editar" "in1Day": "Dentro de 1 dia" "inUse": "Em utiliza "inXDays": "Dentro de $1 dias", "join": "Participar", "manage": "Gerir", "membership": "ASSOCIA "membershipAdded": "New membership added" "membershipCardHolderFirstName": "Nome prprio" "membershipCardHolderLastName": "Apelido" "membershipCardHolderMiddleName": "Nome do meio" "membershipCardHolderName": "TITULAR DO CART "membershipCopied": "Membership number copied", "membershipFormAddButtonLabel": "Adicionar", "membershipFormNumber": "Nmero", "membershipFormOptionalField": "(Opcional)", "membershipFormSaveButtonLabel": "Guardar", "membershipInvalid": "Required field(s) missing", "membershipNumber": "N. DE ASSOCIA "membershipRemoveTitle": "Are you sure to remove?" "membershipRemoved": "Membership removed" "membershipType": "Tipo de associa "membershipUpdated": "Membership updated", "memberships": "Associaes", "open": "Abrir", "openTicketUrlMessage": "Abra a pgina \"$1\" para gerir as suas reservas.", "openUrlTitle": "Abrir o \"$1\"", "passwordLeakActionMessage": "As palavras-passe de $1 apareceram em fugas", "passwordLeakActionMessageSingular": "Uma palavra-passe apareceu em fugas de informa "passwordSectionTitle": "$1 palavras-passe divulgadas" "passwordSectionTitleSingular": "1 palavra-passe divulgada" "passwordSectionViewMore": "Ver mais $1 palavras-passe divulgadas" "passwordSectionViewMoreSingular": "Ver mais 1 palavra-passe divulgada" "passwords": "Palavras-passe" "paymentSectionAddNew": "Adicionar um novo cart "paymentSectionTitle": "Mtodos de pagamento", "providedBy": "Fornecido por $1", "remove": "Remover", "removeTicketMessage": "Remover este passe da Carteira", "rewards": "Recompensas", "tickets": "Pedidos", "ticketsEmptySubTitle": "Podemos sincronizar os seus bilhetes do Bing Travel e do Outlook para a Carteira agora.", "ticketsEmptyTitle": "Ainda no existem pedidos", "ticketsViewExpired": "Ver $1 passes expirados", "ticketsViewExpiredSingular": "Ver 1 passe expirado", "today": "Hoje", "tomorrow": "Amanh "wallet": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalles", "actionsAndUpcomingTitle": "Acciones y prximos", "address": "Direcciones", "all": "Todos", "bookingId": "Id. de reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Tarjetas", "cashback": "Reembolso", "checkIn": "Registro", "checkOut": "Salida", "digitalIdMembershipAddMembership": "Agregar nueva", "digitalIdMembershipEmptySubtitle": "Almacenamos tu suscripcin para ayudarte a rellenar rpidamente la informacin cuando reserves vuelos y proporcionamos diversas funcionalidades para maximizar tus ahorros consecuentemente.", "digitalIdMembershipEmptyTitle": "An no hay ninguna suscripci "done": "Listo" "earn": "Ganar" "edit": "Editar" "in1Day": "En 1 d "inUse": "En uso", "inXDays": "En $1 das", "join": "Unirse", "manage": "Administrar", "membership": "MEMBRES "membershipAdded": "New membership added" "membershipCardHolderFirstName": "Nombre" "membershipCardHolderLastName": "Apellidos" "membershipCardHolderMiddleName": "Segundo nombre" "membershipCardHolderName": "TITULAR" "membershipCopied": "Membership number copied" "membershipFormAddButtonLabel": "Agregar" "membershipFormNumber": "Nmero" "membershipFormOptionalField": "(Opcional)" "membershipFormSaveButtonLabel": "Guardar" "membershipInvalid": "Required field(s) missing" "membershipNumber": "NO DE PERTENENCIA." "membershipRemoveTitle": "Are you sure to remove?" "membershipRemoved": "Membership removed" "membershipType": "Tipo de suscripci "membershipUpdated": "Membership updated", "memberships": "Suscripciones", "open": "Abrir", "openTicketUrlMessage": "Abra la pgina \"$1\" para administrar sus reservas.", "openUrlTitle": "Abrir \"$1\"", "passwordLeakActionMessage": "Han aparecido $1 contraseas en filtraciones", "passwordLeakActionMessageSingular": "Ha aparecido 1 contrasea en filtraciones", "passwordSectionTitle": "$1 Contraseas filtradas por", "passwordSectionTitleSingular": "1 contrasea filtrada", "passwordSectionViewMore": "Ver $1 ms contraseas filtradas", "passwordSectionViewMoreSingular": "Ver 1 contrases filtradas", "passwords": "Contraseas", "paymentSectionAddNew": "Agregar una nueva tarjeta", "paymentSectionTitle": "Mtodos de pago", "providedBy": "Proporcionado por $1", "remove": "Quitar", "removeTicketMessage": "Quitar este pase de Cartera", "rewards": "Recompensas", "tickets": "Entradas", "ticketsEmptySubTitle": "Ahora podemos sincronizar sus vales de Bing Travel y Outlook con Cartera.", "ticketsEmptyTitle": "An no hay ningn vale", "ticketsViewExpired": "Ver $1 pases expirados", "ticketsViewExpiredSingular": "Ver 1 pase expirado", "today": "Hoy", "tomorrow": "Maana", "wallet": "Cartera"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalhes", "actionsAndUpcomingTitle": "Aes e prximos passos", "address": "Endereos", "all": "Tudo", "bookingId": "ID da Reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Cartes", "cashback": "Cashback", "checkIn": "Fazer check-in", "checkOut": "Check-out", "digitalIdMembershipAddMembership": "Adicionar novo", "digitalIdMembershipEmptySubtitle": "Armazenamos sua associao para ajudar voc a preencher rapidamente as informaes ao reservar passagens areas e fornecer diversos recursos para maximizar suas economias adequadamente.", "digitalIdMembershipEmptyTitle": "Ainda n nenhuma associa "done": "Concludo" "earn": "Ganhe" "edit": "Editar" "in1Day": "Em 1 dia" "inUse": "Em uso" "inXDays": "Em $1 dias" "join": "Ingressar" "manage": "Gerenciar" "membership": "ASSOCIA "membershipAdded": "New membership added", "membershipCardHolderFirstName": "Nome", "membershipCardHolderLastName": "Sobrenome", "membershipCardHolderMiddleName": "Sobrenome", "membershipCardHolderName": "TITULAR", "membershipCopied": "Membership number copied", "membershipFormAddButtonLabel": "Adicionar", "membershipFormNumber": "Nmero", "membershipFormOptionalField": "(Opcional)", "membershipFormSaveButtonLabel": "Salvar", "membershipInvalid": "Required field(s) missing", "membershipNumber": "N. DE ASSOCIAO.", "membershipRemoveTitle": "Are you sure to remove?", "membershipRemoved": "Membership removed", "membershipType": "Tipo de associa "membershipUpdated": "Membership updated" "memberships": "Associaes" "open": "Abrir" "openTicketUrlMessage": "Abra a pgina \"$1\" para gerenciar suas reservas." "openUrlTitle": "Abra o \"$1\"" "passwordLeakActionMessage": "Senhas de $1 apareceram em vazamentos" "passwordLeakActionMessageSingular": "A senha de $1 apareceu em vazamentos" "passwordSectionTitle": "$1 senhas vazadas" "passwordSectionTitleSingular": "1 senha vazada" "passwordSectionViewMore": "Exibir mais $1 senhas vazadas" "passwordSectionViewMoreSingular": "Exibir mais 1 senha vazada" "passwords": "Senhas" "paymentSectionAddNew": "Adicionar um novo cart "paymentSectionTitle": "Formas de pagamento", "providedBy": "Fornecido por $1", "remove": "Remover", "removeTicketMessage": "Remover este passe da Carteira", "rewards": "Rewards", "tickets": "Tquetes", "ticketsEmptySubTitle": "Podemos sincronizar seus tquetes do Bing Travel e do Outlook para a Carteira agora.", "ticketsEmptyTitle": "Ainda n nenhum tquete", "ticketsViewExpired": "Exibir $1 passes expirados", "ticketsViewExpiredSingular": "Exibir 1 passagem expirada", "today": "Hoje", "tomorrow": "Amanh "wallet": "Carteira"" (Indicator: ""ver ") in Source: strings.json82:T5bb,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",0" [Source: 1dM49pQ2.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",0" [Source: 1dM49pQ2.exe.log] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00006284-00000BC1-56711364] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00007352-00000BC1-57265227] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00007228-00000BC1-57838830] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00001332-00000BC1-58381547] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00000580-00000C28-1491874563] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000564-00000C28-743038003]83:T442,"AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"84:T8c7,Observed string: ""curlbible.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlcandi.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curldaze.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curldefinition.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlflip.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlfriendcollective.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlfrodisiac.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlkalon.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlmix.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curls.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsandpotions.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsdynasty.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsmith.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsnolye.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsofcolor.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsponge.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curltastic.co"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyair.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlycupcakes.ca"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlygirlboutique.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlygirlzcandy.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyheaven.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlykisses.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyshayco.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyshiny.com"," (Indicator: ""curl") in Source: wallet-stable.json85:T6e2,Observed email domain:""colourpop.com"," [Source: wallet-stable.json] Observed email domain:""aepop.net"," [Source: wallet-stable.json] Observed email domain:""artpop.com"," [Source: wallet-stable.json] Observed email domain:""avenuepop.com"," [Source: wallet-stable.json] Observed email domain:""bassettbmx.com"," [Source: wallet-stable.json] Observed email domain:""canvasmx.com"," [Source: wallet-stable.json] Observed email domain:""drinkolipop.com"," [Source: wallet-stable.json] Observed email domain:""fashionfunpop.com"," [Source: wallet-stable.json] Observed email domain:""fastandloosebmx.com"," [Source: wallet-stable.json] Observed email domain:""flitebmx.com"," [Source: wallet-stable.json] Observed email domain:""fofopop.com"," [Source: wallet-stable.json] Observed email domain:""gellipop.com"," [Source: wallet-stable.json] Observed email domain:""gforcemx.com"," [Source: wallet-stable.json] Observed email domain:""happipop.com"," [Source: wallet-stable.json] Observed email domain:""hauzofpop.com"," [Source: wallet-stable.json] Observed email domain:""hiccapop.com"," [Source: wallet-stable.json] Observed email domain:""hijabipop.com"," [Source: wallet-stable.json] Observed email domain:""jellypop.la"," [Source: wallet-stable.json] Observed email domain:""kinkbmx.com"," [Source: wallet-stable.json] Observed email domain:""kloudkpop.com"," [Source: wallet-stable.json] Observed email domain:""knitpop.com"," [Source: wallet-stable.json] Observed email domain:""kpop.exchange"," [Source: wallet-stable.json] Observed email domain:""laperlamx.com"," [Source: wallet-stable.json] Observed email domain:""lovepop.com"," [Source: wallet-stable.json] Observed email domain:""lullipop.com"," [Source: wallet-stable.json]86:T7cf,"Ll8cp20.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00007352) "Ll8cp20.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007352) "UU5HX65.exe" called "FindFirstFileA" with parameter %TEMP%\IXP002.TMP\* (UID: 00000000-00007228) "UU5HX65.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007228) "bk3UW74.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00001332) "bk3UW74.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001332) "1dM49pQ2.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00000580) "1dM49pQ2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Healer\* (UID: 00000000-00000580)87:T765,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "GetDC" (Indicator: "GetDC"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006284.00000000.70258.00EFA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006284.00000000.70258.00EFA000.00000002.mdmp")88:T4a9,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001892.00000000.70944.02CA0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006284.00000000.70258.00EFA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006284.00000000.70258.00EFA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006284.00000000.70258.00EFA000.00000002.mdmp")89:T1063,"0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\LL8CP20.EXE"; Value: "") "0b3a82c1a567e16e191a934df57ab14db3c6b8cc3836e2a52b8b5ae12d005d78.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\5YY8RN9.EXE"; Value: "") "Ll8cp20.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\UU5HX65.EXE"; Value: "") "Ll8cp20.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\4WU689PY.EXE"; Value: "") "UU5HX65.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\BK3UW74.EXE"; Value: "") "UU5HX65.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\3PT32VF.EXE"; Value: "") "bk3UW74.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1DM49PQ2.EXE"; Value: "") "bk3UW74.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2ZC0213.EXE"; Value: "") "2Zc0213.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "2Zc0213.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "3pt32Vf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "3pt32Vf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "")8a:T75b,""4amscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""6whiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""99centsubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""allieandmickey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""alteregoscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""annabelbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""aspirefashionscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""augustbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""bananasmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""baseballmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""beautiiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""beautyandwhiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""bellagracehealthscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""belleandbubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""beyondblessedscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""blingbykey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""boosted-luckey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""bowlingmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""burgeonbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""busybeescrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""cabbagekey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""coatsandscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""codenxtscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""cognitiontsscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""concreterosescrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com")8b:T110f,Dropped file: "1dM49pQ2.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\1dM49pQ2.exe.log]- [targetUID: 00000000-00000580] Dropped file: "000009.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00005800] Dropped file: "000013.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00005800] Dropped file: "000014.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00005800] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00005800] Dropped file: "f_0004c7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00001724] Dropped file: "040988e0-3788-450e-82f1-45548400662f.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\040988e0-3788-450e-82f1-45548400662f.tmp]- [targetUID: 00000000-00005800] Dropped file: "f_0004c8" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00001724] Dropped file: "55e1422b-dbe7-497a-b74f-02f255a6cbd9.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\55e1422b-dbe7-497a-b74f-02f255a6cbd9.tmp]- [targetUID: 00000000-00005800] Dropped file: "cc829a29-783e-4c0e-a3bc-402e6786eabe.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cc829a29-783e-4c0e-a3bc-402e6786eabe.tmp]- [targetUID: 00000000-00005800] Dropped file: "accfc415-cbed-4a5b-8f81-960dd471b24e.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\accfc415-cbed-4a5b-8f81-960dd471b24e.tmp]- [targetUID: 00000000-00005800] Dropped file: "ce10ee5c-57e1-4b13-8004-36b461455c87.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ce10ee5c-57e1-4b13-8004-36b461455c87.tmp]- [targetUID: 00000000-00005800] Dropped file: "b93ad108-1fff-47b3-a8ac-a865e2c0a40d.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b93ad108-1fff-47b3-a8ac-a865e2c0a40d.tmp]- [targetUID: 00000000-00005800] Dropped file: "6df2a79e-48bf-41f8-ad43-c841aca8d71d.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\6df2a79e-48bf-41f8-ad43-c841aca8d71d.tmp]- [targetUID: 00000000-00005800] Dropped file: "1a1b8ef7-dced-4763-9200-7f0454503160.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\1a1b8ef7-dced-4763-9200-7f0454503160.tmp]- [targetUID: 00000000-00005800] Dropped file: "14291bd2-2705-4569-b743-34196a9aa4e8.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\14291bd2-2705-4569-b743-34196a9aa4e8.tmp]- [targetUID: 00000000-00005800] Dropped file: "f_0004c6" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00001724] Dropped file: "cdb01182-4637-40f3-b9c0-ee03b8e4e469.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cdb01182-4637-40f3-b9c0-ee03b8e4e469.tmp]- [targetUID: 00000000-00005800] Dropped file: "cabe06f0-30e1-42ef-8b6c-5461a4b9d9ef.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cabe06f0-30e1-42ef-8b6c-5461a4b9d9ef.tmp]- [targetUID: 00000000-00005800] Dropped file: "d08fa5c5-2794-4866-b88b-52e9919a32d7.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\d08fa5c5-2794-4866-b88b-52e9919a32d7.tmp]- [targetUID: 00000000-00005800] Dropped file: "e88ade74-0947-4ca6-b7f6-746cf7327e4b.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e88ade74-0947-4ca6-b7f6-746cf7327e4b.tmp]- [targetUID: 00000000-00005800] Dropped file: "915a0873-e679-4057-b7e0-4a56a7320d14.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\915a0873-e679-4057-b7e0-4a56a7320d14.tmp]- [targetUID: 00000000-00005800] Dropped file: "afed3117-af56-47ef-887b-4552abacdfe7.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\afed3117-af56-47ef-887b-4552abacdfe7.tmp]- [targetUID: 00000000-00005800] Dropped file: "f_0004c5" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00001724] Dropped file: "f_0004c4" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00001724]8c:T4001,"initAft()