26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 8c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 24b66c0d6f26… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 24b66c0d6f26…. Malware family: Trojan.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 22 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/24b66c0d6f26f5de09b4cb7a2496bf87ad0ed9d45e846870dee70941b565bc3c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","24b66c0d6f26f5de09b4cb7a2496bf87ad0ed9d45e846870dee70941b565bc3c"],"about":{"@type":"SoftwareApplication","name":"WEXTRACT.exe","applicationCategory":["peexe","executable"],"identifier":"24b66c0d6f26f5de09b4cb7a2496bf87ad0ed9d45e846870dee70941b565bc3c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":25},"behavioralIndicators":{"malicious":22,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4aa,"WEXTRACT.exe" called "FindResourceA" with parameter "16388728" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388736" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388764" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388976" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388792" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388948" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388960" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "14939956" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388844" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388940" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "14939952" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388808" - (UID: 00000000-00007500) "WEXTRACT.exe" called "FindResourceA" with parameter "16388816" - (UID: 00000000-00007500)28:Ta9f,"WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435328'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435184'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435344'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435232'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435200'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435248'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435296'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435168'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435280'}" (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16435312'}" (UID: 00000000-00007500) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695168'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695024'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695184'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695072'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695040'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695088'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695136'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695008'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695120'}" (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20695152'}" (UID: 00000000-00007712) "nf4rn60.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2410624'}" (UID: 00000000-00008176) "nf4rn60.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2410480'}" (UID: 00000000-00008176) "nf4rn60.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2410640'}" (UID: 00000000-00008176)29:T882,"WEXTRACT.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007500) "Rw4YT03.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007712) "Rw4YT03.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007712) "nf4rn60.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00008176) "nf4rn60.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00008176) "nf4rn60.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00008176) "FJ4OU94.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005336) "FJ4OU94.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00005336) "FJ4OU94.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00005336) "FJ4OU94.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00005336) "kK0yG24.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004660) "kK0yG24.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004660) "kK0yG24.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004660) "kK0yG24.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00004660) "kK0yG24.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00004660) "qP5Qb44.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00001308) "qP5Qb44.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00001308) "qP5Qb44.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00001308) "qP5Qb44.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00001308) "qP5Qb44.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00001308) "qP5Qb44.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP (UID: 00000000-00001308) "qP5Qb44.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP\ (UID: 00000000-00001308)2a:T468,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "WEXTRACT.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "WEXTRACT.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")2b:T404,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "WEXTRACT.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "WEXTRACT.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")2c:T61a,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "WEXTRACT.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "WEXTRACT.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "WEXTRACT.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6dg6UC8.exe.460690676") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")2d:Tdb1,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "WEXTRACT.exe") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")2e:T24fd,"WEXTRACT.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007500) "WEXTRACT.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007500) "Rw4YT03.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007712) "Rw4YT03.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007712) "nf4rn60.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008176) "nf4rn60.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008176) "FJ4OU94.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005336) "FJ4OU94.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005336) "kK0yG24.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004660) "kK0yG24.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004660) "qP5Qb44.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001308) "qP5Qb44.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001308) "1rs14bk1.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002228) "1rs14bk1.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002228) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007472)2f:Ta42,"WEXTRACT.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f5e300cc7d8a7310932f0300000000e8f5e30024478a7310932f0340f6e300d5278a7310932f030100000057e0980700000000e842431a0000000003000000f4f6e3000a0000009402000038f7e30070f6e3005900000003000000f8f5e30000f6e30008f9e30050598a739706f774feffffff48f7e30047f28873e842431a (UID: 00000000-00007500) "Rw4YT03.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fbef00cc7d8a73b0b92a0100000000b8fbef0024478a73b0b92a0110fcef00d5278a73b0b92a0101000000b053cba000000000741267290000000003000000c4fcef000a0000005806000008fdef0040fcef005d00000003000000c8fbef00d0fbef00d8feef0050598a7320bfa8d3feffffff18fdef0047f2887374126729 (UID: 00000000-00007712) "nf4rn60.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f56700cc7d8a73c0ac8e020000000068f5670024478a73c0ac8e02c0f56700d5278a73c0ac8e020100000095fcdfda00000000120ff615000000000300000074f667000a000000dc0d0000b8f66700f0f567005b0000000300000078f5670080f5670088f8670050598a73d51934a9feffffffc8f6670047f28873120ff615 (UID: 00000000-00008176) "FJ4OU94.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007d8a73e8aede0200000000b8fba30024478a73e8aede0210fca300d5278a73e8aede0201000000598e880900000000e83dee180000000003000000c4fca3000a0000007811000008fda30040fca3005b00000003000000c8fba300d0fba300dcfea30050598a73c962a77afeffffff1cfda30047f28873e83dee1800000000 (UID: 00000000-00005336) "kK0yG24.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007d8a73c0ace6020000000008f8910024478a73c0ace60260f89100d5278a73c0ace60201000000479fdc5300000000f2aaa817000000000300000014f991000a0000001c1e000058f9910090f891005b0000000300000018f8910020f891002cfb910050598a73a777c120feffffff6cf9910047f28873f2aaa81700000000 (UID: 00000000-00004660) "qP5Qb44.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f88700cc7d8a7348bacd020000000060f8870024478a7348bacd02b8f88700d5278a7348bacd0201000000d693c4300000000008d8471700000000030000006cf987000a000000981c0000b0f98700e8f887005b0000000300000070f8870078f8870080fb870050598a73ee7bcf43feffffffc0f9870047f2887308d84717 (UID: 00000000-00001308) "AppLaunch.exe" called "GetVersionExA" with parameter 94000000060000000300000080250000020000000000000016000016a1ea000060d3e002a8cede02100000006052e0020100000003000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d00 (UID: 00000000-00007472)30:T7af,"WEXTRACT.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WEXTRACT.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Rw4YT03.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Rw4YT03.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "nf4rn60.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "nf4rn60.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "FJ4OU94.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "FJ4OU94.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "kK0yG24.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "kK0yG24.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "qP5Qb44.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "qP5Qb44.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1rs14bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1rs14bk1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Ro9432.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Ro9432.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")31:T440,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "WEXTRACT.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "WEXTRACT.exe") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")32:T83c,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "WEXTRACT.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "WEXTRACT.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "WEXTRACT.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "7ct2pQ14.exe.3385136014") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "7848120690,7708,3024,,RtlGetVersion,NTDLL.dll,"00:17:30.593",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "994468776,4472,3024,,RtlGetVersion,NTDLL.dll,"00:17:27.281",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")33:T29f4,"WEXTRACT.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007500) "WEXTRACT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007500) "Rw4YT03.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007712) "Rw4YT03.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007712) "nf4rn60.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008176) "nf4rn60.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008176) "nf4rn60.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008176) "nf4rn60.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008176) "nf4rn60.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008176) "nf4rn60.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00008176) "nf4rn60.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00008176) "FJ4OU94.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005336) "FJ4OU94.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005336) "FJ4OU94.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005336) "FJ4OU94.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005336) "FJ4OU94.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005336) "FJ4OU94.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005336) "FJ4OU94.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005336) "kK0yG24.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004660) "kK0yG24.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004660) "kK0yG24.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004660) "kK0yG24.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004660) "kK0yG24.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004660) "kK0yG24.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004660) "kK0yG24.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004660) "qP5Qb44.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001308) "qP5Qb44.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001308) "qP5Qb44.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001308) "qP5Qb44.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001308) "qP5Qb44.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001308) "qP5Qb44.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00001308) "qP5Qb44.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001308) "1rs14bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002228) "1rs14bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002228) "1rs14bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002228) "1rs14bk1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002228) "1rs14bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002228) "1rs14bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002228) "1rs14bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002228) "1rs14bk1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002228) "1rs14bk1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002228) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007472) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007472) "2Ro9432.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000980) "2Ro9432.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000980) "2Ro9432.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000980) "2Ro9432.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000980) "2Ro9432.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000980) "2Ro9432.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000980) "2Ro9432.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000980) "2Ro9432.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000980) "2Ro9432.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000980) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005004) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005004) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005004) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005004) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00005004) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005004) "3Hm09Ej.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004768) "3Hm09Ej.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004768) "3Hm09Ej.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004768) "3Hm09Ej.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004768)34:Tefcb,"WEXTRACT.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007500) "WEXTRACT.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007500) "Rw4YT03.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007712) "Rw4YT03.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007712) "nf4rn60.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00008176) "nf4rn60.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00008176) "FJ4OU94.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005336) "FJ4OU94.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005336) "kK0yG24.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004660) "kK0yG24.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004660) "qP5Qb44.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00001308) "qP5Qb44.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001308) "1rs14bk1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002228) "1rs14bk1.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00002228) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007472) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007472) "2Ro9432.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000980) "2Ro9432.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00000980) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005004) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00005004) "3Hm09Ej.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004768) "3Hm09Ej.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004768)35:T17bf,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "WEXTRACT.exe") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.00990000.00000004.mdmp, 00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "7849951154,7708,3136,,CreateProcessA,kernel32.dll,"00:17:30.593",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004768.00000000.67558.02A40000.00000004.mdmp, 00000000-00004768.00000001.69478.00500000.00000004.mdmp, 00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.00500000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004768.00000001.69478.00500000.00000004.mdmp, 00000000-00004768.00000002.71400.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02B40000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp")36:Tdd1,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "WEXTRACT.exe") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")37:T80c,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "WEXTRACT.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "6dg6UC8.exe.460690676") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")38:Te753,Found reference to API (Indicator: "CheckTokenMembership"; File: "WEXTRACT.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "WEXTRACT.exe") Found reference to API (Indicator: "DecryptFileA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "WEXTRACT.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "FreeSid"; File: "WEXTRACT.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "WEXTRACT.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "WEXTRACT.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "EqualSid"; File: "WEXTRACT.exe") Found reference to API (Indicator: "RegCloseKey"; File: "WEXTRACT.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "WEXTRACT.exe") Found reference to API (Indicator: "FindNextFileA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "FindClose"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LocalAlloc"; File: "WEXTRACT.exe") Found reference to API (Indicator: "lstrcmpA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CompareStringA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetLastError"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "DeleteFileA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GlobalFree"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CloseHandle"; File: "WEXTRACT.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetProcAddress"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GlobalLock"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LocalFree"; File: "WEXTRACT.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "FreeLibrary"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "WEXTRACT.exe") Found reference to API (Indicator: "ReadFile"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SizeofResource"; File: "WEXTRACT.exe") Found reference to API (Indicator: "WriteFile"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetFileTime"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetFilePointer"; File: "WEXTRACT.exe") Found reference to API (Indicator: "FindResourceA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CreateMutexA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "FreeResource"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetVersion"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetTempPathA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CreateFileA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetEvent"; File: "WEXTRACT.exe") Found reference to API (Indicator: "TerminateThread"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetVersionExA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LockResource"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CreateThread"; File: "WEXTRACT.exe") Found reference to API (Indicator: "ResetEvent"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LoadResource"; File: "WEXTRACT.exe") Found reference to API (Indicator: "ExitProcess"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CreateProcessA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "FormatMessageA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CreateEventA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CharUpperA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "WEXTRACT.exe") Found reference to API (Indicator: "MessageBeep"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CharPrevA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "LoadStringA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CharNextA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "EnableWindow"; File: "WEXTRACT.exe") Found reference to API (Indicator: "ReleaseDC"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "WEXTRACT.exe") Found reference to API (Indicator: "PeekMessageA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SendMessageA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "MessageBoxA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "ShowWindow"; File: "WEXTRACT.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetWindowPos"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetDC"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetWindowRect"; File: "WEXTRACT.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "Sleep"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "WEXTRACT.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "WEXTRACT.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "WEXTRACT.exe") Found reference to API (Indicator: "TerminateProcess"; File: "WEXTRACT.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetTickCount"; File: "WEXTRACT.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "WEXTRACT.exe") Found reference to API (Indicator: "MulDiv"; File: "WEXTRACT.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "WEXTRACT.exe") Found reference to API (Indicator: "MessageBoxW"; File: "1rs14bk1.exe.1312326192") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "1rs14bk1.exe.1312326192") Found reference to API (Indicator: "GetActiveWindow"; File: "1rs14bk1.exe.1312326192") Found reference to API (Indicator: "GetLastActivePopup"; File: "1rs14bk1.exe.1312326192") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "1rs14bk1.exe.1312326192") Found reference to API (Indicator: "LocateXStateFeature"; File: "1rs14bk1.exe.1312326192") Found reference to API (Indicator: "VirtualFree"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "VirtualAlloc"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "InitializeSListHead"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "RtlUnwind"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "SetLastError"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "EnterCriticalSection"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "TlsAlloc"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "TlsGetValue"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "TlsSetValue"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "TlsFree"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "LoadLibraryExW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetStdHandle"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "HeapFree"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "HeapAlloc"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "HeapReAlloc"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "LCMapStringW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "FindFirstFileExW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "FindNextFileW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "IsValidCodePage"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetACP"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetOEMCP"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetCPInfo"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetCommandLineA"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetCommandLineW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "SetStdHandle"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetFileType"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetStringTypeW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetProcessHeap"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "HeapSize"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "FlushFileBuffers"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "GetConsoleMode"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "SetFilePointerEx"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "CreateFileW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "WriteConsoleW"; File: "6dg6UC8.exe.460690676") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "7ct2pQ14.exe.3385136014") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "7ct2pQ14.exe.3385136014") Found reference to API (Indicator: "RtlGetVersion"; File: "7ct2pQ14.exe.3385136014") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "7ct2pQ14.exe.3385136014") Found reference to API (Indicator: "GetLongPathNameW"; File: "7ct2pQ14.exe.3385136014") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "7ct2pQ14.exe.3385136014") Found reference to API (Indicator: "UnregisterWait"; File: "7ct2pQ14.exe.3385136014") Found reference to API (Indicator: "GetCurrentThread"; File: "7ct2pQ14.exe.3385136014") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004660.00000001.69266.00301000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004660.00000001.69266.00301000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004660.00000001.69266.00301000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005336.00000000.67317.001D1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005336.00000000.67317.001D1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00005336.00000000.67317.001D1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")39:T9a9,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "WEXTRACT.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "WEXTRACT.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "WEXTRACT.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "WEXTRACT.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "WEXTRACT.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")3a:Tb7a,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp")3b:T442,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "WEXTRACT.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "WEXTRACT.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "6dg6UC8.exe.460690676") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")3c:T766,"WEXTRACT.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Rw4YT03.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "nf4rn60.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4ew995pG.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2Ro9432.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "FJ4OU94.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1rs14bk1.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "kK0yG24.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qP5Qb44.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5NS8xD0.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "6dg6UC8.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3d:T268d,"WEXTRACT.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "WEXTRACT.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "WEXTRACT.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "WEXTRACT.exe" loaded module "KERNEL32" at base 76850000 "WEXTRACT.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "WEXTRACT.exe" loaded module "KERNEL32.DLL" at base 76850000 "WEXTRACT.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77190000 "WEXTRACT.exe" loaded module "FECLIENT.DLL" at base 733c0000 "WEXTRACT.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73390000 "WEXTRACT.exe" loaded module "NTDLL.DLL" at base 77a10000 "WEXTRACT.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74380000 "Rw4YT03.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "Rw4YT03.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "Rw4YT03.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "Rw4YT03.exe" loaded module "KERNEL32" at base 76850000 "Rw4YT03.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "Rw4YT03.exe" loaded module "KERNEL32.DLL" at base 76850000 "Rw4YT03.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77190000 "Rw4YT03.exe" loaded module "FECLIENT.DLL" at base 733c0000 "Rw4YT03.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73390000 "Rw4YT03.exe" loaded module "NTDLL.DLL" at base 77a10000 "Rw4YT03.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74380000 "nf4rn60.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "nf4rn60.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "nf4rn60.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "nf4rn60.exe" loaded module "KERNEL32" at base 76850000 "nf4rn60.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "nf4rn60.exe" loaded module "KERNEL32.DLL" at base 76850000 "nf4rn60.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77190000 "nf4rn60.exe" loaded module "FECLIENT.DLL" at base 733c0000 "nf4rn60.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73390000 "nf4rn60.exe" loaded module "NTDLL.DLL" at base 77a10000 "nf4rn60.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74380000 "FJ4OU94.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "FJ4OU94.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "FJ4OU94.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "FJ4OU94.exe" loaded module "KERNEL32" at base 76850000 "FJ4OU94.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "FJ4OU94.exe" loaded module "KERNEL32.DLL" at base 76850000 "FJ4OU94.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77190000 "FJ4OU94.exe" loaded module "FECLIENT.DLL" at base 733c0000 "FJ4OU94.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73390000 "FJ4OU94.exe" loaded module "NTDLL.DLL" at base 77a10000 "FJ4OU94.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74380000 "kK0yG24.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "kK0yG24.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "kK0yG24.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "kK0yG24.exe" loaded module "KERNEL32" at base 76850000 "kK0yG24.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "kK0yG24.exe" loaded module "KERNEL32.DLL" at base 76850000 "kK0yG24.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77190000 "kK0yG24.exe" loaded module "FECLIENT.DLL" at base 733c0000 "kK0yG24.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73390000 "kK0yG24.exe" loaded module "NTDLL.DLL" at base 77a10000 "kK0yG24.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74380000 "qP5Qb44.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "qP5Qb44.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "qP5Qb44.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "qP5Qb44.exe" loaded module "KERNEL32" at base 76850000 "qP5Qb44.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "qP5Qb44.exe" loaded module "KERNEL32.DLL" at base 76850000 "qP5Qb44.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77190000 "qP5Qb44.exe" loaded module "FECLIENT.DLL" at base 733c0000 "qP5Qb44.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73390000 "qP5Qb44.exe" loaded module "NTDLL.DLL" at base 77a10000 "qP5Qb44.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74380000 "1rs14bk1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "1rs14bk1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "1rs14bk1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "1rs14bk1.exe" loaded module "KERNEL32" at base 76850000 "1rs14bk1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "1rs14bk1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 77210000 "1rs14bk1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77210000 "1rs14bk1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77210000 "1rs14bk1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77210000 "1rs14bk1.exe" loaded module "NTDLL.DLL" at base 77a10000 "1rs14bk1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74380000 "1rs14bk1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 762d0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "AppLaunch.exe" loaded module "KERNEL32" at base 76850000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 77190000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 732d0000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 76550000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 762d0000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74150000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72b20000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76150000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77210000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 73360000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 765a0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 749b0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76850000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70940000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 76400000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 75d50000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 765a0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77210000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 729c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6fee0000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 74430000 "AppLaunch.exe" loaded module "ADVAPI32" at base 77190000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77a10000 "2Ro9432.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "2Ro9432.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "2Ro9432.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "2Ro9432.exe" loaded module "KERNEL32" at base 76850000 "2Ro9432.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "2Ro9432.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 77210000 "2Ro9432.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77210000 "2Ro9432.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77210000 "2Ro9432.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77210000 "2Ro9432.exe" loaded module "NTDLL.DLL" at base 77a10000 "2Ro9432.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74380000 "2Ro9432.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 762d0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 77210000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 762d0000 "3Hm09Ej.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77210000 "3Hm09Ej.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77210000 "3Hm09Ej.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77210000 "3Hm09Ej.exe" loaded module "KERNEL32" at base 76850000 "3Hm09Ej.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73830000 "3Hm09Ej.exe" loaded module "USER32" at base 76150000 "3Hm09Ej.exe" loaded module "ADVAPI32" at base 77190000 "3Hm09Ej.exe" loaded module "SHELL32" at base 74a100003e:T60a,"WEXTRACT.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "WEXTRACT.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "Rw4YT03.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "Rw4YT03.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "nf4rn60.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "nf4rn60.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "FJ4OU94.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "FJ4OU94.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "kK0yG24.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "kK0yG24.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "qP5Qb44.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "qP5Qb44.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "1rs14bk1.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "1rs14bk1.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "2Ro9432.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "2Ro9432.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73660000 "3Hm09Ej.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 762E0000 "3Hm09Ej.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 736600003f:T1310,"WEXTRACT.exe" was detected as "Microsoft Cabinet" and name: "sfx" "WEXTRACT.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "WEXTRACT.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WEXTRACT.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "WEXTRACT.exe" was detected as "Microsoft Linker" and name: "Linker" "Rw4YT03.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Rw4YT03.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Rw4YT03.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Rw4YT03.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Rw4YT03.exe" was detected as "Microsoft Linker" and name: "Linker" "nf4rn60.exe" was detected as "Microsoft Cabinet" and name: "sfx" "nf4rn60.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "nf4rn60.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "nf4rn60.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "nf4rn60.exe" was detected as "Microsoft Linker" and name: "Linker" "4ew995pG.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4ew995pG.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4ew995pG.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4ew995pG.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4ew995pG.exe" was detected as "Microsoft Linker" and name: "Linker" "2Ro9432.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Ro9432.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Ro9432.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Ro9432.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Ro9432.exe" was detected as "Microsoft Linker" and name: "Linker" "FJ4OU94.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FJ4OU94.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FJ4OU94.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FJ4OU94.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FJ4OU94.exe" was detected as "Microsoft Linker" and name: "Linker" "1rs14bk1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1rs14bk1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1rs14bk1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1rs14bk1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1rs14bk1.exe" was detected as "Microsoft Linker" and name: "Linker" "kK0yG24.exe" was detected as "Microsoft Cabinet" and name: "sfx" "kK0yG24.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "kK0yG24.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "kK0yG24.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "kK0yG24.exe" was detected as "Microsoft Linker" and name: "Linker" "qP5Qb44.exe" was detected as "Microsoft Cabinet" and name: "sfx" "qP5Qb44.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "qP5Qb44.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qP5Qb44.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "qP5Qb44.exe" was detected as "Microsoft Linker" and name: "Linker" "5NS8xD0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5NS8xD0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5NS8xD0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5NS8xD0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5NS8xD0.exe" was detected as "Microsoft Linker" and name: "Linker" "6dg6UC8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6dg6UC8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6dg6UC8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6dg6UC8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6dg6UC8.exe" was detected as "Microsoft Linker" and name: "Linker" "7ct2pQ14.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7ct2pQ14.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7ct2pQ14.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7ct2pQ14.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7ct2pQ14.exe" was detected as "Microsoft Linker" and name: "Linker" "3Hm09Ej.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Hm09Ej.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Hm09Ej.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Hm09Ej.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Hm09Ej.exe" was detected as "Microsoft Linker" and name: "Linker"40:T19a3,"WEXTRACT.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Rw4YT03.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "nf4rn60.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4ew995pG.exe" file has an entrypoint instructions - "jmp 0x441ca5,jmp 0x458b52,jmp 0x44a320,jmp 0x4353e7,jmp 0x416b20,jmp 0x4a3960,jmp 0x435956,jmp 0x459935,jmp 0x4ac089,jmp 0x41bf7a,jmp 0x442df8,jmp 0x41aa7f,jmp 0x452cc0,jmp 0x42b40b,jmp 0x4770bf,jmp 0x4131f0,jmp 0x49234b,jmp 0x413320,jmp 0x454085,jmp 0x470ef4," "2Ro9432.exe" file has an entrypoint instructions - "jmp 0x441ca5,jmp 0x458b52,jmp 0x44a320,jmp 0x4353e7,jmp 0x416b20,jmp 0x4a3960,jmp 0x435956,jmp 0x459935,jmp 0x4ac089,jmp 0x41bf7a,jmp 0x442df8,jmp 0x41aa7f,jmp 0x452cc0,jmp 0x42b40b,jmp 0x4770bf,jmp 0x4131f0,jmp 0x49234b,jmp 0x413320,jmp 0x454085,jmp 0x470ef4," "FJ4OU94.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1rs14bk1.exe" file has an entrypoint instructions - "jmp 0x441ca5,jmp 0x458b52,jmp 0x44a320,jmp 0x4353e7,jmp 0x416b20,jmp 0x4a3960,jmp 0x435956,jmp 0x459935,jmp 0x4ac089,jmp 0x41bf7a,jmp 0x442df8,jmp 0x41aa7f,jmp 0x452cc0,jmp 0x42b40b,jmp 0x4770bf,jmp 0x4131f0,jmp 0x49234b,jmp 0x413320,jmp 0x454085,jmp 0x470ef4," "kK0yG24.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "qP5Qb44.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5NS8xD0.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "6dg6UC8.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42cd34," "7ct2pQ14.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "3Hm09Ej.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4],"41:T6bc,"WEXTRACT.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "WEXTRACT.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WEXTRACT.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Rw4YT03.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Rw4YT03.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Rw4YT03.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "nf4rn60.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "nf4rn60.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "nf4rn60.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "FJ4OU94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "FJ4OU94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "FJ4OU94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "kK0yG24.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "kK0yG24.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "kK0yG24.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "qP5Qb44.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "qP5Qb44.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "qP5Qb44.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1rs14bk1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")42:Tca7,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007500-00000C25-42669245] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00007500-00000C25-42735663] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007500-00000BC1-42749565] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00007712-00000BC1-43340491] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00008176-00000BC1-43807314] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00005336-00000BC1-44292265] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00004660-00000BC1-44629623] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"" [Source: 00000000-00001308-00000BC1-44997712] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007472-00000C25-45955254] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007472-00000C25-46286614] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007472-00000C25-46441599] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007472-00000C25-46495705] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007472-00000C25-46609403] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007472-00000C25-46704803] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007472-00000C25-46771443] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007472-00000C25-46877629] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007472-00000C25-47061388] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007472-00000C25-47528029] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log]43:T405,"WEXTRACT.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Rw4YT03.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "nf4rn60.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "4ew995pG.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "2Ro9432.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "FJ4OU94.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1rs14bk1.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "kK0yG24.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "qP5Qb44.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5NS8xD0.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "6dg6UC8.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "7ct2pQ14.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "3Hm09Ej.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE44:T437,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "WEXTRACT.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "WEXTRACT.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6dg6UC8.exe.460690676") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")45:T7a7,"Rw4YT03.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Rw4YT03.exe]- [targetUID: 00000000-00007712] "nf4rn60.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\nf4rn60.exe]- [targetUID: 00000000-00008176] "4ew995pG.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4ew995pG.exe]- [targetUID: 00000000-00005336] "2Ro9432.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2Ro9432.exe]- [targetUID: 00000000-00001308] "FJ4OU94.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\FJ4OU94.exe]- [targetUID: 00000000-00008176] "1rs14bk1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1rs14bk1.exe]- [targetUID: 00000000-00002228] "kK0yG24.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\kK0yG24.exe]- [targetUID: 00000000-00005336] "qP5Qb44.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\qP5Qb44.exe]- [targetUID: 00000000-00001308] "5NS8xD0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5NS8xD0.exe]- [targetUID: 00000000-00008176] "6dg6UC8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6dg6UC8.exe]- [targetUID: 00000000-00007712] "7ct2pQ14.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7ct2pQ14.exe]- [targetUID: 00000000-00007500] "3Hm09Ej.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3Hm09Ej.exe]- [targetUID: 00000000-00004768] "AppLaunch.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00007472]46:T542,"WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")47:T680,"WEXTRACT.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Rw4YT03.exe" (UID: 7500) "Rw4YT03.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nf4rn60.exe" (UID: 7712) "nf4rn60.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FJ4OU94.exe" (UID: 8176) "FJ4OU94.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\kK0yG24.exe" (UID: 5336) "kK0yG24.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\qP5Qb44.exe" (UID: 4660) "kK0yG24.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3Hm09Ej.exe" (UID: 4660) "qP5Qb44.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1rs14bk1.exe" (UID: 1308) "qP5Qb44.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2Ro9432.exe" (UID: 1308) "1rs14bk1.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 2228) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7472) "AppLaunch.exe" queries basic process information of the "C:\Windows\System32\winlogon.exe" (UID: 7472) "AppLaunch.exe" queries basic process information of the "C:\Windows\servicing\TrustedInstaller.exe" (UID: 7472) "2Ro9432.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 980)48:Ta7d,"WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "WEXTRACT.EXE"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")49:Tb91,"WEXTRACT.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "WEXTRACT.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "WEXTRACT.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "WEXTRACT.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "WEXTRACT.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RW4YT03.EXE" "WEXTRACT.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Rw4YT03.exe" "WEXTRACT.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7CT2PQ14.EXE" "WEXTRACT.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7ct2pQ14.exe" "Rw4YT03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Rw4YT03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "Rw4YT03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "Rw4YT03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "Rw4YT03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\NF4RN60.EXE" "Rw4YT03.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nf4rn60.exe" "Rw4YT03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6DG6UC8.EXE" "Rw4YT03.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6dg6UC8.exe" "nf4rn60.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "nf4rn60.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "nf4rn60.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "nf4rn60.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "nf4rn60.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FJ4OU94.EXE" "nf4rn60.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FJ4OU94.exe" "nf4rn60.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5NS8XD0.EXE" "nf4rn60.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5NS8xD0.exe" "FJ4OU94.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"4a:T8b6,"WEXTRACT.exe" trying to access non-existent file "\Device\HarddiskVolume2\WEXTRACT.EXE.LOCAL" "WEXTRACT.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "WEXTRACT.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Rw4YT03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RW4YT03.EXE.LOCAL" "Rw4YT03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Rw4YT03.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "nf4rn60.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\NF4RN60.EXE.LOCAL" "nf4rn60.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "nf4rn60.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "FJ4OU94.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FJ4OU94.EXE.LOCAL" "FJ4OU94.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "FJ4OU94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "kK0yG24.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\KK0YG24.EXE.LOCAL" "kK0yG24.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "kK0yG24.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "qP5Qb44.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\QP5QB44.EXE.LOCAL" "qP5Qb44.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "qP5Qb44.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"4b:T929,"qP5Qb44.exe" called "FindFirstFileA" with parameter %TEMP%\IXP005.TMP\* (UID: 00000000-00001308) "qP5Qb44.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001308) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007472) "AppLaunch.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007472)4c:Tad1,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "WEXTRACT.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "WEXTRACT.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")4d:T4ae,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "WEXTRACT.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "WEXTRACT.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "6dg6UC8.exe.460690676") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "6dg6UC8.exe.460690676") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")4e:T713,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "WEXTRACT.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "WEXTRACT.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "WEXTRACT.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6dg6UC8.exe.460690676") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6dg6UC8.exe.460690676") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")4f:Tbc7,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "WEXTRACT.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "WEXTRACT.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "WEXTRACT.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")50:T660,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "WEXTRACT.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "WEXTRACT.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")51:Te84,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "WEXTRACT.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "WEXTRACT.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "WEXTRACT.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "WEXTRACT.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "WEXTRACT.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "WEXTRACT.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "WEXTRACT.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "WEXTRACT.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")52:T627,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "WEXTRACT.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "WEXTRACT.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "WEXTRACT.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")53:T841,Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00004660.00000000.67346.032E0000.00000002.mdmp, 00000000-00004660.00000001.69266.032E0000.00000002.mdmp, 00000000-00004660.00000002.71186.032E0000.00000002.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00004768.00000000.67558.02DF0000.00000002.mdmp, 00000000-00004768.00000001.69478.02DF0000.00000002.mdmp, 00000000-00004768.00000002.71400.02DF0000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00005336.00000000.67317.030D0000.00000002.mdmp, 00000000-00005336.00000001.69238.030D0000.00000002.mdmp, 00000000-00005336.00000002.71158.030D0000.00000002.mdmp")54:T9b4,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "WEXTRACT.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "WEXTRACT.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")55:T7fd,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "WEXTRACT.exe") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")56:T993,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "WEXTRACT.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "WEXTRACT.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "WEXTRACT.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "WEXTRACT.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "WEXTRACT.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004660.00000001.69266.00301000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004660.00000001.69266.00301000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005336.00000000.67317.001D1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005336.00000000.67317.001D1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")57:T839,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "WEXTRACT.exe") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")58:T100d,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "WEXTRACT.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "WEXTRACT.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "WEXTRACT.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "WEXTRACT.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "WEXTRACT.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004660.00000001.69266.02E40000.00000004.mdmp, 00000000-00004660.00000002.71186.02E40000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004768.00000001.69478.02810000.00000004.mdmp, 00000000-00004768.00000002.71400.02810000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00005336.00000000.67317.02DC0000.00000004.mdmp, 00000000-00005336.00000001.69238.02DC0000.00000004.mdmp, 00000000-00005336.00000002.71158.02DC0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")59:T451,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "WEXTRACT.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "WEXTRACT.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "1rs14bk1.exe.1312326192") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004660.00000001.69266.0030A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005336.00000000.67317.001DA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007500.00000000.67218.00FAA000.00000002.mdmp")5a:T12b1,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: WEXTRACT.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: WEXTRACT.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: WEXTRACT.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: WEXTRACT.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: WEXTRACT.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Rw4YT03.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Rw4YT03.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Rw4YT03.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Rw4YT03.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Rw4YT03.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: nf4rn60.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: nf4rn60.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: nf4rn60.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: nf4rn60.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: nf4rn60.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: FJ4OU94.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: FJ4OU94.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: FJ4OU94.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: FJ4OU94.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: FJ4OU94.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: kK0yG24.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: kK0yG24.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: kK0yG24.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: kK0yG24.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: kK0yG24.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: qP5Qb44.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: qP5Qb44.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: qP5Qb44.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: qP5Qb44.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: qP5Qb44.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5NS8xD0.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5NS8xD0.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5NS8xD0.exe]5b:T9a9,"WEXTRACT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\RW4YT03.EXE"; Value: "") "Rw4YT03.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\NF4RN60.EXE"; Value: "") "nf4rn60.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\FJ4OU94.EXE"; Value: "") "FJ4OU94.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\KK0YG24.EXE"; Value: "") "kK0yG24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\QP5QB44.EXE"; Value: "") "kK0yG24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\3HM09EJ.EXE"; Value: "") "qP5Qb44.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\1RS14BK1.EXE"; Value: "") "qP5Qb44.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\2RO9432.EXE"; Value: "") "1rs14bk1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "2Ro9432.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "")5c:T710,"Rw4YT03.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Rw4YT03.exe]- [targetUID: 00000000-00007712] "nf4rn60.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\nf4rn60.exe]- [targetUID: 00000000-00008176] "4ew995pG.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4ew995pG.exe]- [targetUID: 00000000-00005336] "2Ro9432.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2Ro9432.exe]- [targetUID: 00000000-00001308] "FJ4OU94.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\FJ4OU94.exe]- [targetUID: 00000000-00008176] "1rs14bk1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1rs14bk1.exe]- [targetUID: 00000000-00002228] "kK0yG24.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\kK0yG24.exe]- [targetUID: 00000000-00005336] "qP5Qb44.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\qP5Qb44.exe]- [targetUID: 00000000-00001308] "5NS8xD0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5NS8xD0.exe]- [targetUID: 00000000-00008176] "6dg6UC8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6dg6UC8.exe]- [targetUID: 00000000-00007712] "7ct2pQ14.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7ct2pQ14.exe]- [targetUID: 00000000-00007500] "3Hm09Ej.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3Hm09Ej.exe]- [targetUID: 00000000-00004768]5d:T46d,"WEXTRACT.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Rw4YT03.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "nf4rn60.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "FJ4OU94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "kK0yG24.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "qP5Qb44.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1rs14bk1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2Ro9432.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3Hm09Ej.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")5e:T710,"Rw4YT03.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Rw4YT03.exe]- [targetUID: 00000000-00007712] "nf4rn60.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\nf4rn60.exe]- [targetUID: 00000000-00008176] "4ew995pG.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4ew995pG.exe]- [targetUID: 00000000-00005336] "2Ro9432.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2Ro9432.exe]- [targetUID: 00000000-00001308] "FJ4OU94.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\FJ4OU94.exe]- [targetUID: 00000000-00008176] "1rs14bk1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1rs14bk1.exe]- [targetUID: 00000000-00002228] "kK0yG24.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\kK0yG24.exe]- [targetUID: 00000000-00005336] "qP5Qb44.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\qP5Qb44.exe]- [targetUID: 00000000-00001308] "5NS8xD0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5NS8xD0.exe]- [targetUID: 00000000-00008176] "6dg6UC8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6dg6UC8.exe]- [targetUID: 00000000-00007712] "7ct2pQ14.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7ct2pQ14.exe]- [targetUID: 00000000-00007500] "3Hm09Ej.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3Hm09Ej.exe]- [targetUID: 00000000-00004768]5f:T81c,"WEXTRACT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "WEXTRACT.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Rw4YT03.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Rw4YT03.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "nf4rn60.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "nf4rn60.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "FJ4OU94.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "FJ4OU94.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "kK0yG24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "kK0yG24.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"") "qP5Qb44.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "qP5Qb44.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP5"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"")60:T12b5,"WEXTRACT.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Rw4YT03.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "WEXTRACT.exe" wrote 1024 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7ct2pQ14.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Rw4YT03.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nf4rn60.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Rw4YT03.exe" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6dg6UC8.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "nf4rn60.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FJ4OU94.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "nf4rn60.exe" wrote 29696 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5NS8xD0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "FJ4OU94.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\kK0yG24.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "FJ4OU94.exe" wrote 28672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\4ew995pG.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "kK0yG24.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\qP5Qb44.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "kK0yG24.exe" wrote 25088 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3Hm09Ej.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "qP5Qb44.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1rs14bk1.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "qP5Qb44.exe" wrote 18432 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2Ro9432.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...61:T9fe,"WEXTRACT.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Rw4YT03.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Rw4YT03.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "nf4rn60.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "nf4rn60.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "nf4rn60.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "FJ4OU94.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "FJ4OU94.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "FJ4OU94.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "FJ4OU94.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "kK0yG24.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "kK0yG24.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "kK0yG24.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "kK0yG24.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "kK0yG24.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "qP5Qb44.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "qP5Qb44.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "qP5Qb44.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "qP5Qb44.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "qP5Qb44.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "qP5Qb44.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" with delete access "qP5Qb44.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2Ro9432.exe" with delete access "qP5Qb44.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1rs14bk1.exe" with delete access62:T560,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA GetTempPathW OutputDebugStringW CreateThreadpoolWait GetModuleFileNameW IsDebuggerPresent LoadLibraryExW ExitThread GetModuleHandleExW CreateThreadpoolWork SleepConditionVariableCS GetFileSizeEx FindNextFileW FindFirstFileExW CreateFileW GetNativeSystemInfo GetCommandLineW SleepConditionVariableSRW GetCommandLineA GetTickCount64 CreateThreadpoolTimer LookupAccountNameA GetUserNameA GetDriveTypeW GetThreadContext WriteProcessMemory CopyFileA GetVersionExW ReadProcessMemory DeleteFileW GetComputerNameExW VirtualAllocEx GetModuleHandleA VirtualAlloc ShellExecuteA HttpSendRequestA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetOpenW CreateDirectoryW GetTempFileNameW LoadLibraryW GetSystemDirectoryW FindResourceW CreateProcessW ShellExecuteExW GetWindowThreadProcessId63:T588,48/72 Antivirus vendors marked dropped file "Rw4YT03.exe" as malicious (classified as "Kryptik.JKR.gen" with 66% detection rate) 49/72 Antivirus vendors marked dropped file "nf4rn60.exe" as malicious (classified as "Kryptik.JKR.gen" with 68% detection rate) 41/71 Antivirus vendors marked dropped file "4ew995pG.exe" as malicious (classified as "Trojan.Generic" with 57% detection rate) 56/72 Antivirus vendors marked dropped file "2Ro9432.exe" as malicious (classified as "Trojan.Kryptik" with 77% detection rate) 49/72 Antivirus vendors marked dropped file "FJ4OU94.exe" as malicious (classified as "Trojan.Kryptik" with 68% detection rate) 49/72 Antivirus vendors marked dropped file "kK0yG24.exe" as malicious (classified as "Kryptik.JKR.gen" with 68% detection rate) 49/72 Antivirus vendors marked dropped file "qP5Qb44.exe" as malicious (classified as "Trojan.Kryptik" with 68% detection rate) 58/72 Antivirus vendors marked dropped file "5NS8xD0.exe" as malicious (classified as "Amadey" with 80% detection rate) 55/72 Antivirus vendors marked dropped file "6dg6UC8.exe" as malicious (classified as "Trojan.Stealerc" with 76% detection rate) 37/72 Antivirus vendors marked dropped file "7ct2pQ14.exe" as malicious (classified as "Trojan.Generic" with 51% detection rate) 51/72 Antivirus vendors marked dropped file "3Hm09Ej.exe" as malicious (classified as "Gen:Trojan.Heur" with 70% detection rate)64:T9d0,"WEXTRACT.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Rw4YT03.exe" (Handle: 656) "Rw4YT03.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\nf4rn60.exe" (Handle: 656) "nf4rn60.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FJ4OU94.exe" (Handle: 124) "FJ4OU94.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\kK0yG24.exe" (Handle: 652) "kK0yG24.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\qP5Qb44.exe" (Handle: 656) "kK0yG24.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3Hm09Ej.exe" (Handle: 124) "qP5Qb44.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1rs14bk1.exe" (Handle: 648) "qP5Qb44.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2Ro9432.exe" (Handle: 124) "1rs14bk1.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "1rs14bk1.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "1rs14bk1.exe" wrote 00002400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "1rs14bk1.exe" wrote 00000600 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2Ro9432.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 620) "2Ro9432.exe" wrote 00000400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 620) "2Ro9432.exe" wrote 00023200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 620) "2Ro9432.exe" wrote 00006200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 620) "2Ro9432.exe" wrote 00000E00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 620) "2Ro9432.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 620) "2Ro9432.exe" wrote 00003200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 620)65:T1d22,Contains base64 string in header "Keep" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s.ss2.us" Contains base64 string in header "User" in header "GET /r.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s.ss2.us" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "2Bmc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2BXrrguICEAxnRZO2jQMmUC0dFSq96X0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2F3I1N1E" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m03.amazontrust.com"66:T740,"explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")67:T63c,"5NS8xD0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLOTHE.EXE") "5NS8xD0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLOTHE.EXE") "explothe.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "explothe.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "schtasks.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "schtasks.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "DONTUSEDESKTOPCHANGEROUTER") "schtasks.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "schtasks.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH") "cmd.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "USESHORTNAME") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "APPENDPATH") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "PATH")68:T970,"schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS"; Key: "")69:T58d,"schtasks.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "schtasks.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "schtasks.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")6a:Td47,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00001760.00000000.67876.02350000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")6b:Tbbd,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "WEXTRACT.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "44CE.bat") file/memory contains long string with (Indicator: "paypal"; File: "AKQO0XU6.txt") file/memory contains long string with (Indicator: "paypal"; File: "5RPFPTWX.txt") file/memory contains long string with (Indicator: "paypal"; File: "71SYJ178.txt") file/memory contains long string with (Indicator: "paypal"; File: "OX9Q37FF.txt") file/memory contains long string with (Indicator: "paypal"; File: "QFCAD9JF.txt") file/memory contains long string with (Indicator: "paypal"; File: "7T3VXKF3.txt") file/memory contains long string with (Indicator: "paypal"; File: "DS2THSLB.txt") file/memory contains long string with (Indicator: "paypal"; File: "C1WFO3D3.txt") file/memory contains long string with (Indicator: "paypal"; File: "UF69XG2W.txt") file/memory contains long string with (Indicator: "youtube"; File: "OW1LSRFX.txt") file/memory contains long string with (Indicator: "paypal"; File: "MMCVD35D.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "JO96147J.txt") Found string "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751" (Indicator: "paypal"; File: "TYA2AZS1.txt") Found string "VISITOR_INFO1_LIVE8z6KcRRlgfoyoutube.com/9217411306316831114942127331372631078746CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921719559784963108154967325771931078746" (Indicator: "youtube"; File: "VN12SIB6.txt") Found string "0Q1qKP2xSxo3ZLKVY..BljQTT.xs.AAA.0.0.BljQTT.AWWdAzhGMEQfacebook.com/921750989952310968381375575978310787380wSNZSvbW3lR_BLUiofgB77yfacebook.com/9217159544409631159199137642602731078738" (Indicator: "facebook.com"; File: "BLMCLCXU.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921719559784963108154967325771931078746" (Indicator: "youtube"; File: "64JU9EWI.txt") Found string "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751" (Indicator: "paypal"; File: "7A1UIKSH.txt") Found string "0Q1qKP2xSxo3ZLKVY..BljQTT.xs.AAA.0.0.BljQTT.AWWdAzhGMEQfacebook.com/92175098995231096838137557597831078738" (Indicator: "facebook.com"; File: "9IP8CK01.txt") Found string "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751" (Indicator: "paypal"; File: "OYCH6P63.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "t.paypal.com" (Indicator: "paypal"; File: "PCAP")6c:T3343,"@shift /0start "" https://accounts.google.comstart "" https://www.facebook.com/loginstart "" https://accounts.google.comstart "" https://store.steampowered.com/login/start "" https://twitter.com/i/flow/loginstart "" https://steamcommunity.com/openid/loginform/start "" https://www.epicgames.com/id/loginstart "" https://www.paypal.com/signinstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751vreXpYrS%3D1798435050%26vteXpYrS%3D1703742450%26vr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9d%26vtyp%3Dnewpaypal.com/9217244779033631299009232322637731078751ts_cvr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9dpaypal.com/1025244779033631299009232322637731078751" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751vreXpYrS%3D1798348654%26vteXpYrS%3D1703742454%26vr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9d%26vtyp%3Dnewpaypal.com/9217248779033631299009361534383031078753ts_cvr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9dpaypal.com/1025244779033631299009232322637731078751" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751vreXpYrS%3D1798348653%26vteXpYrS%3D1703742453%26vr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9d%26vtyp%3Dnewpaypal.com/9217247779033631299009361534383031078753ts_cvr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9dpaypal.com/1025248779033631299009421521583331078753" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751vreXpYrS%3D1798348653%26vteXpYrS%3D1703742453%26vr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9d%26vtyp%3Dnewpaypal.com/9217247779033631299009361534383031078753ts_cvr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9dpaypal.com/1025248779033631299009421552783431078753" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751vreXpYrS%3D1798348654%26vteXpYrS%3D1703742454%26vr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9d%26vtyp%3Dnewpaypal.com/9217248779033631299009361534383031078753ts_cvr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9dpaypal.com/1025248779033631299009421521583331078753" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751vreXpYrS%3D1798348653%26vteXpYrS%3D1703742453%26vr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9d%26vtyp%3Dnewpaypal.com/9217247779033631299009361534383031078753ts_cvr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9dpaypal.com/102524777903363129900921918453931078754" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751vreXpYrS%3D1798348653%26vteXpYrS%3D1703742453%26vr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9d%26vtyp%3Dnewpaypal.com/9217247779033631299009361534383031078753ts_cvr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9dpaypal.com/1025248779033631299009421552783431078753" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751vreXpYrS%3D1798435050%26vteXpYrS%3D1703742450%26vr%3Daedb34b418c0a55240ccc4f4fd541c9e%26vt%3Daedb34b418c0a55240ccc4f4fd541c9d%26vtyp%3Dnewpaypal.com/9217244779033631299009232322637731078751" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751tsrceunifiedloginnodewebpaypal.com/9217278860454431079336232322637731078751" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751LANGen_US%3BUSpaypal.com/9217269127142431078806232307037631078751" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751d_id22e3129b1921464d916e5d8067ca99321703740650721paypal.com/9217157668006431813591232307037631078751" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751cookie_checkpaypal.com/9217157668006431813591232307037631078751" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025269017523231152158232307037631078751" (Indicator: "paypal.com") "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "1c9d; Path=/; Domain=paypal.com; Expires=Sun, 27 Dec 2026 05:17:30 GMT; SecureTraceparent: 00-0000000000000000000f1359751eb461-1786687ea73536fc-01X-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=blockDC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesVia: 1.1 varnish, 1.1 varnish, 1.1 varnishDate: Thu, 28 Dec 2023 05:17:30 GMTStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Served-By: cache-bur-kbur8200061-BUR, cache-sjc1000084-SJC, cache-sjc1000084-SJCX-Cache: MISS, MISS, MISSX-Cache-Hits: 0, 0, 0X-Timer: S1703740651.660694,VS0,VE124Vary: Accept-EncodingServer-Timing: "traceparent;desc="00-0000000000000000000f1359751eb461-a4a2527b81ab97f2-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"transfer-encoding: chunked" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Headers: x-csrf-tokenAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *Cache-Control: max-age=31536000, s-maxage=31536000Content-Type: text/cssDate: Thu, 28 Dec 2023 05:17:31 GMTDC: ccg11-origin-www-1.paypal.comEtag: W/"657bddfd-25c40"Expires: Fri, 27 Dec 2024 05:17:31 GMTLast-Modified: Fri, 15 Dec 2023 05:02:53 GMTPaypal-Debug-Id: dbb30d00ff4deServer: ECAcc (sac/256C)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000dbb30d00ff4de-ab82af08f7454088-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 23917" (Indicator: "paypal.com") "GET /webstatic/i/consumer/onboarding/sprite_form_2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /paypal-ui/logos/svg/paypal-mark-color.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Medium.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Regular.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /paypal-ui/icons/svg/chevron-right.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Origin: *Cache-Control: s-maxage=31536000, public,max-age=3600Content-Type: image/svg+xmlDate: Thu, 28 Dec 2023 05:17:33 GMTDC: ccg11-origin-www-1.paypal.comEtag: "62aa5e30-436"Expires: Thu, 28 Dec 2023 06:17:33 GMTLast-Modified: Wed, 15 Jun 2022 22:33:20 GMTPaypal-Debug-Id: f11712e304660Server: ECAcc (sac/2530)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000f11712e304660-824e85db65da5584-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 548" (Indicator: "paypal.com") "HTTP/1.1 200 OKAccept-CH: DPR, Viewport-Width, Width, ECT, DownlinkAccept-Ranges: bytesCache-Control: s-maxage=31536000, public,max-age=3600Content-Type: image/pngDate: Thu, 28 Dec 2023 05:17:33 GMTDC: ccg11-origin-www-1.paypal.comEtag: "540587dd-1555"Expires: Thu, 28 Dec 2023 06:17:33 GMTLast-Modified: Tue, 02 Sep 2014 09:03:25 GMTPaypal-Debug-Id: fe041fc71e5f6Server: ECAcc (sac/2546)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000fe041fc71e5f6-685c2ba9ed4ecfda-01X-Cache: HITX-Content-Type-Options: nosniffContent-Length: 5461" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Origin: *Cache-Control: s-maxage=31536000, public,max-age=3600Content-Type: application/vnd.ms-fontobjectDate: Thu, 28 Dec 2023 05:17:33 GMTDC: ccg11-origin-www-1.paypal.comEtag: W/"560b6e70-a4fc"Expires: Thu, 28 Dec 2023 06:17:33 GMTLast-Modified: Wed, 30 Sep 2015 05:09:04 GMTPaypal-Debug-Id: 2e052a3410145Server: ECAcc (sac/254B)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-00000000000000000002e052a3410145-6c6d406fae8c4dea-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 42180" (Indicator: "paypal.com")6d:T195e,"GET /r2m02.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 511709 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=7200 Cache-Control: public Date: Thu 28 Dec 2023 04:47:37 GMT ETag: "658ce856-7cedd" Expires: Thu 28 Dec 2023 06:47:37 GMT Last-Modified: Thu 28 Dec 2023 03:15:34 GMT Server: nginx X-Cache: Hit from cloudfront Via: 1.1 2484d95e1962e4fa6652ac5bdc660206.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P6 X-Amz-Cf-Id: 4ua93X_HgWd7YzjZgzbak-wBH1Ui1suPLHumlTtagR3oETB6jUq_wA== Age: 1790 with response body ==>....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 713 Connection: keep-alive Last-Modified: Wed 27 Dec 2023 14:25:57 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: c0MHf6W7plCkwfzc1UXaMHZfAiNNwQmp Accept-Ranges: bytes Server: AmazonS3 Date: Thu 28 Dec 2023 03:08:16 GMT ETag: "3e33a5a4c765e34883bae32bd5a2c6e5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 01dbe7e23991a177a7cdfba5803db41c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-C1 X-Amz-Cf-Id: Gkn7rYXTeEz_rCw_u3caR1Fq0mVi3QjJil8VMJZxk9cDkBu5LNqU_w== Age: 7752 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1529 Connection: keep-alive Date: Thu 28 Dec 2023 04:56:50 GMT Last-Modified: Thu 28 Dec 2023 04:56:50 GMT ETag: 981eadae62310d63f5b688dc84b290b46f57d7a2 Expires: Thu 04 Jan 2024 04:56:50 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Wed 27 Dec 2023 09:01:28 GMT X-Sucuri-ID: 11036 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Wed 27 Dec 2023 06:34:12 GMT Expires: Thu 28 Dec 2023 06:34:12 GMT ETag: "566e99ec0e730996019fccbbbcc8164e431a5223" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: EXPIRED X-Cache: Hit from cloudfront Via: 1.1 8a7696c9764ab79132ce2754e8e20bec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: BpHYxhoFxPI7UJWdb5A3AReCMeK1EKNeb-Eo2Bu0_WXMSCz4OFpn6g== Age: 72959 with response body ==>....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 651 Connection: keep-alive Last-Modified: Wed 27 Dec 2023 14:26:27 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: CzlYGdrn0Szi2DOUHGErb1s1qVyFWnfL Accept-Ranges: bytes Server: AmazonS3 Date: Thu 28 Dec 2023 02:19:32 GMT ETag: "0d49c9c04d55cf50443a568d38a24928" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 22d43bf299ac98b08849f5a01a8af246.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: Zr81viUizTiXAmyTGFlx8a4k8dmXGqlfNHOVlOAJ_cq30vabqfg96A== Age: 10676 with response body ==>....... "GET /r.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: s.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 486 Connection: keep-alive Last-Modified: Wed 08 Nov 2023 23:31:41 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: vh9_.F5f0qUMnY3L0UoDMODo4pSLvpbc Accept-Ranges: bytes Server: AmazonS3 Date: Thu 28 Dec 2023 05:04:47 GMT ETag: "a8fb889989c036b9c5f50300861d295c" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5e4ed8b3ad7ea224ed1bfcac62553bf6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: i5iCV73DVsYcx9piRL06koSEu1sMF3_y0vFtag05i7A-4HzABEPOgQ== Age: 761 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1407 Connection: keep-alive Date: Thu 28 Dec 2023 04:27:51 GMT Last-Modified: Thu 28 Dec 2023 04:27:51 GMT ETag: f45d6dd4f83efc4a40e336fd9fcbf605207ffcc8 Expires: Thu 04 Jan 2024 04:27:51 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Thu 28 Dec 2023 04:07:46 GMT Server: ECAcc (sac/2532) X-Cache: Hit from cloudfront Via: 1.1 f77c10214ffa0d9105c6d388503d2882.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P3 X-Amz-Cf-Id: 8vcoaHwLOzVcj9N96jT46p_w1dCHU6IXA03IWB8XpqibOMvSJoCSMQ== Age: 4181 with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEATz2IlpoaRYSkOX%2F3I1N1E%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m03.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Thu 28 Dec 2023 03:55:47 GMT Server: ECAcc (sac/2530) X-Cache: Hit from cloudfront Via: 1.1 2ecd59b4298afe9d7bb9266870458a74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: QwzgEBSzwYfr95qz6eVMv27OkbDVFm5-ly8H9vigYdKg47dVEuCnrg== Age: 4905 with response body ==>.......6e:T1938,"AppLaunch.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "5NS8xD0.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5NS8xD0.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5NS8xD0.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5NS8xD0.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5NS8xD0.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5NS8xD0.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5NS8xD0.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "explothe.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "explothe.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "explothe.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "schtasks.exe" touched "Groove GFS Browser Helper" (Path: "HKCU\CLSID\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}") "schtasks.exe" touched "Office Document Cache Handler" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\INPROCSERVER32") "schtasks.exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "schtasks.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "schtasks.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "schtasks.exe" touched "History" (Path: "HKCU\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\INPROCSERVER32") "schtasks.exe" touched "UIAnimationManager2" (Path: "HKCU\CLSID\{D25D8842-8884-4A4A-B321-091314379BDD}\TREATAS") "schtasks.exe" touched "UIAnimationTransitionLibrary2" (Path: "HKCU\CLSID\{812F944A-C5C8-4CD9-B0A6-B3DA802F228D}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "schtasks.exe" touched "ShellWindows" (Path: "HKCU\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\TREATAS") "schtasks.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "schtasks.exe" touched "WebBrowserHandler Proxy" (Path: "HKCU\CLSID\{3CB169B3-17D9-4E47-8B93-2878998F69A2}\TREATAS") "schtasks.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "schtasks.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\TREATAS") "schtasks.exe" touched "Browser Thread State" (Path: "HKCU\CLSID\{A6B222AB-A5EA-4899-B230-084657EDDC7D}\TREATAS") "schtasks.exe" touched "Browser Application State" (Path: "HKCU\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS") "schtasks.exe" touched "JScript Language" (Path: "HKCU\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "schtasks.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "schtasks.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")6f:T62e,"~DF2C83C27C2E6A3FE2.TMP" has type "data" - Location: [%TEMP%\~DF2C83C27C2E6A3FE2.TMP] "~DF6FB1D093BCD9D8A5.TMP" has type "data" - Location: [%TEMP%\~DF6FB1D093BCD9D8A5.TMP] "~DF67887C7E68DAFD3D.TMP" has type "data" - Location: [%TEMP%\~DF67887C7E68DAFD3D.TMP] "~DF4BC0E667C9B5AFA2.TMP" has type "data" - Location: [%TEMP%\~DF4BC0E667C9B5AFA2.TMP] "~DF462E21A36E0B65E3.TMP" has type "data" - Location: [%TEMP%\~DF462E21A36E0B65E3.TMP] "~DF6AA7BEEA66E45102.TMP" has type "data" - Location: [%TEMP%\~DF6AA7BEEA66E45102.TMP] "~DF6345C8EB51EB2B99.TMP" has type "data" - Location: [%TEMP%\~DF6345C8EB51EB2B99.TMP] "~DFB265A966C048515A.TMP" has type "data" - Location: [%TEMP%\~DFB265A966C048515A.TMP] "~DF4C5F105D31E1211A.TMP" has type "data" - Location: [%TEMP%\~DF4C5F105D31E1211A.TMP] "~DF48FBAE98E5F12BA9.TMP" has type "data" - Location: [%TEMP%\~DF48FBAE98E5F12BA9.TMP] "~DFB0A74DBCF47B4B14.TMP" has type "data" - Location: [%TEMP%\~DFB0A74DBCF47B4B14.TMP] "~DF43C338EBCE7416F2.TMP" has type "data" - Location: [%TEMP%\~DF43C338EBCE7416F2.TMP] "~DF1CFF707AA03289B0.TMP" has type "data" - Location: [%TEMP%\~DF1CFF707AA03289B0.TMP] "~DF680BAC9673EC5F7F.TMP" has type "data" - Location: [%TEMP%\~DF680BAC9673EC5F7F.TMP] "~DF8D181D2A51259218.TMP" has type "data" - Location: [%TEMP%\~DF8D181D2A51259218.TMP] "~DFB1B3D542C606B9CF.TMP" has type "data" - Location: [%TEMP%\~DFB1B3D542C606B9CF.TMP] "~DF690DEB4CD2A5B772.TMP" has type "data" - Location: [%TEMP%\~DF690DEB4CD2A5B772.TMP] "~DF868A2A321296041D.TMP" has type "data" - Location: [%TEMP%\~DF868A2A321296041D.TMP]70:T7d5,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "")71:T3a82,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:xm1C299emNhBxE33z8RyDy0OMHWL_g:rd8uXYJWZNu1Y4xaConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3bKHTmWaKGIxkb6-797dhrOBCNlWq7OFJ5u9U_F6VoGXNY-jRsPWOYEOhjpPGBG6rZyeC_hQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:-pApEK-WsNcBBbdFwn0mbal_qTjPIQ:CdMKsjHW3eOFVjeq"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2KDBdut779DRp_4H2RZRG7ATiFxOko7NueqmzNK5-Ll6KRfMebrkfYQzB7G_t0eS_GUORCHQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S923095847%3A1703740645370960&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:-pApEK-WsNcBBbdFwn0mbal_qTjPIQ:CdMKsjHW3eOFVjeq"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:-pApEK-WsNcBBbdFwn0mbal_qTjPIQ:CdMKsjHW3eOFVjeq"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:EUAMpyWk3dCXRFZb72AepNqfP97mNA:m2-ZQF9ZLQ0-hUiO"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2FeeP6CAV0ctdfzWSr1h62uWpzbLERcsxD3ZZC2thTLuKVG-DmmKeKKTmsLZ6sJqWF1z6G HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:3KYHu8m3YIwbfil18sHdqsgMf_Ohqg:iygOI32dCEXtH6pFConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp32uaMMN8iqi3QcsfLxw7QoyuGnn75njdXyCx10G7U76REW8uR-x6UPMHstfUsdtQAasn1Xpw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1929315926%3A1703740652304567&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:3KYHu8m3YIwbfil18sHdqsgMf_Ohqg:iygOI32dCEXtH6pF"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=693640342446159339&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=32374&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S923095847:1703740645370960",null,null,"ASKXGp2KDBdut779DRp_4H2RZRG7ATiFxOko7NueqmzNK5-Ll6KRfMebrkfYQzB7G_t0eS_GUORCHQ"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:3KYHu8m3YIwbfil18sHdqsgMf_Ohqg:iygOI32dCEXtH6pF"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:3KYHu8m3YIwbfil18sHdqsgMf_Ohqg:iygOI32dCEXtH6pF"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:PL6AXEiSTFVxZHmFo3NPZ7RvmhWxuw:d3b6Ddl1upiYMrOJ"; in File: "SSL") Found requests in header "GET /generate_204?bac4Ow HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:PL6AXEiSTFVxZHmFo3NPZ7RvmhWxuw:d3b6Ddl1upiYMrOJ"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-270606878288803462&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=34520&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-1929315926:1703740652304567",null,null,"ASKXGp32uaMMN8iqi3QcsfLxw7QoyuGnn75njdXyCx10G7U76REW8uR-x6UPMHstfUsdtQAasn1Xpw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:PL6AXEiSTFVxZHmFo3NPZ7RvmhWxuw:d3b6Ddl1upiYMrOJ; OTZ=7357448_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:PL6AXEiSTFVxZHmFo3NPZ7RvmhWxuw:d3b6Ddl1upiYMrOJ; OTZ=7357448_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:FiKM7htObynjw-XPXFg2GO1DQLWGAw:98N9aJrqOm-7JbZP; OTZ=7357448_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=5.140450974315974e-7&rtembps=-1&rttms=2 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:FiKM7htObynjw-XPXFg2GO1DQLWGAw:98N9aJrqOm-7JbZP; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEE"; in File: "SSL") Found requests in header "GET /restart?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S923095847%3A1703740645370960&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2KDBdut779DRp_4H2RZRG7ATiFxOko7NueqmzNK5-Ll6KRfMebrkfYQzB7G_t0eS_GUORCHQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:FiKM7htObynjw-XPXFg2GO1DQLWGAw:98N9aJrqOm-7JbZP; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEE"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2KDBdut779DRp_4H2RZRG7ATiFxOko7NueqmzNK5-Ll6KRfMebrkfYQzB7G_t0eS_GUORCHQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:NP2eGZxWAQqkatPUQVYWnAqeWGzkQw:xSPYVXAG68CMmO_C; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEEConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=ASKXGp2KDBdut779DRp_4H2RZRG7ATiFxOko7NueqmzNK5-Ll6KRfMebrkfYQzB7G_t0eS_GUORCHQ&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:NP2eGZxWAQqkatPUQVYWnAqeWGzkQw:xSPYVXAG68CMmO_C; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEE"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3beeKzpM2JJpQpZP8mea2eKyswKuoi80Mvfz4WBaQKWscvEtC6UVh_YrRRo17CtmtGtjgO&theme=glif&dsh=S-251495895%3A1703740716245944 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:NP2eGZxWAQqkatPUQVYWnAqeWGzkQw:xSPYVXAG68CMmO_C; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEE"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:NP2eGZxWAQqkatPUQVYWnAqeWGzkQw:xSPYVXAG68CMmO_C; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEE"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-3213492542708260499&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=57447&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-251495895:1703740716245944",null,null,"ASKXGp3beeKzpM2JJpQpZP8mea2eKyswKuoi80Mvfz4WBaQKWscvEtC6UVh_YrRRo17CtmtGtjgO"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:NP2eGZxWAQqkatPUQVYWnAqeWGzkQw:xSPYVXAG68CMmO_C; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEE"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:NP2eGZxWAQqkatPUQVYWnAqeWGzkQw:xSPYVXAG68CMmO_C; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEE"; in File: "SSL") Found requests in header "GET /generate_204?CyQsDQ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:kg_yvpMX1-BJJXfM3LG582-Dnvm_RA:nhiu6MAMG4gIHtnX; OTZ=7357448_52_52_123900_48_436380; NID=511=YMyDVWf0wUYigebu2nLQlX7gUEl4f71XPr5NL_7grP9ZXu-fy7Gu-_u6RQ4iEV8uxpmaXkgX1XXX113I-B6FLR7qBLs5qpyXUR2Jv9OiFdba6bRbkBVI7CuMNQn7F87DU_N8ccJT4ghfvfZ3UuYRt8xcLUzlBEuVVGNhNdoJjEE"; in File: "SSL")72:T4af,Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001760.00000000.67876.000B0000.00000004.mdmp, 00000000-00001760.00000000.67884.0107C000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001760.00000000.67876.000B0000.00000004.mdmp, 00000000-00001760.00000000.67884.0107C000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001760.00000000.67876.000B0000.00000004.mdmp, 00000000-00001760.00000000.67884.0107C000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001760.00000000.67876.000B0000.00000004.mdmp, 00000000-00001760.00000000.67884.0107C000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001760.00000000.67884.0107C000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001760.00000000.67884.0107C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001760.00000000.67884.0107C000.00000002.mdmp")73:T98ba,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: fr=0Q1qKP2xSxo3ZLKVY..BljQTT.xs.AAA.0.0.BljQTT.AWWdAzhGMEQ; expires=Wed, 27-Mar-2024 05:17:07 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponlySet-Cookie: sb=0wSNZSvbW3lR_BLUiofgB77y; expires=Fri, 31-Jan-2025 05:17:07 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponlyreporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img" "-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), encrypted-media=(), fullscreen=(), keyboard-map=()permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMT" "X-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: fFsOXUsEELjVfQ+S6AvIqjNTMCZ1EL+ykWeiSSgXmXYW4QFOTbnvC202O0KHG1aNq90RBKAWMbUt0jzzU1kkdw==Date: Thu, 28 Dec 2023 05:17:07 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-alive" "35ed��[o#K� �>��S3�lk%V�N�Q�*Q�M$u�VO!Y�$S��,eU��e��^؀��0��o��bl�0"�n��j�|/+/Q��Q��e�[��ꉩk��W��0�59��%%�~"��G�Τ�f �9�,�>84�H��]�Ц�9�=��c�0��\l�'��3\��Q�ԧ_��MX��4��:��i�Y�K��ּax��:��>��)�0G,�%��@�/��E�� NG?z��zZ��]��T��_]��'��?��sr�;8x��&y2�q�>\�ؑ��ppR"N��m�ܮe��-mbcե3lI�R�v�ɣ�ϋlkL��M�^��&�cu�sG�a�E�LuҰj��qFNJ.1�cW��y��qN��L�B%�1� WձFu�B�5m�d̐��P��Q��f~�烏��<��q�C2��>��r�9��a�c��QS-��f��=�4�]�ܩ�M�_/�Zwj�^��7��u�H��ZR?�&@$v@�<�Q�:��N]$ �H��:x>��N��ۯ�k�W��U�կU�D��h��O��ڇ �s>�v��%L\�[')�N��:�A��ϰ�81S�mDC�P��6�x'�R�%v��5q��z'\��al'<;� �41f[��}��1#6��bc�Dw�'J:#�b2��'Y�>9��I/��¡��I�7gvb�?-( &�`'N�v��h��q�Bb��{8M��ϱ�ncŢ�;hE��C��u̾��(��M��S�9N��D;Z.��#M��,즘ô#{j��L�T�C'��ɍ#ۚ��V��/y��J%�8Ě%6N$Yd�%l�;�F}0T[�΅��2<>�R:rQ*h��C��C�a[.A��H.q��h��$}j�I�X.��)�n�5t ��V��0��L8SĈ5I K��\x�s{E=L�db�Lb��m`h��Ytqq�f��]�Htr��{��Z�u-��b�8�#��B/� 2�(��^6�MC��`��*��#��" ś��+��Q��rz��P�9Lwe��K7�9�$p�uƙb�})e��$��T�&�T ��\�Hs��TKS�'͇̍]4&��')Bz8��5(�1;�"gz"�<=_I*��!�Ȭ_��ud��樢��d�bd�2F}y�{ç�ב�`ߖn��ߑ��5�9�O��L9s;!��w$�ȼ6��V��Ȝ��^��#�Z�L��\��tZy-7+J��E��^A�4�RN��i �W��=�{g�4�_�m5�LC��o�ΐ��g��j�k24�̓o��Y��?|�4��IJ1ST�i�ɤc%", ")9ұ򜔲�bf�P)*�b.l�K�Ţ�Jd��4�-4�R^t�lK�]�� -�0��R��/f�F�Fi�UA.�s��R�|!S��m&29Y�� Lv?�b��+*�o��|�|�q}|��j6Mې��9f��8�m�A��?Dr��1��t�勤�cEI��&��o��2M:ެI�_��$��ge�c�$�v�x�V�B�ȱkFQϽ��Y�Y�H�S�`��5[��\4*�ng��_�ե��)2��^A�V��"sL�`��2�\Ȝ��b6G��mU�S��+s�9d�rH��u_�HJ��{Pv6�FQ�pY�V��O=�5�[�[`��gGm88]��v4��a�Z�<��T�:��[]�|A�H�/��f�aA.�<��cb`�5��k�@��y�v�E��u��J�:b��8�ҁ��xɱ�>3J�9%�3Z֪V�Z�H�I%��_��yF� U��.��/z�r��֚�^�|��C�~ݬ�;պگ��a�s*%��ՠ٩�i��;S�!T��^O-��N��^��کߨ�^��>��Ww�s)x]�^�[��jyXnu_��3Hoʕ�˝�~��6��Z�v�zM�v۽n��ư�W˵�Z��&�E�n��^7��@mׇ�fu��~�5Sk�rc��;�J��u;ݫ��Oۀ��jւ�z��/�j�>�O��j�]��+��^��HI�׭^ԇj��8}��ݬ��[u^�V�U6��:�W��u��.7[��m}�^��Y��Ԯ�O��m�p�V��탠r\��Y�vՂ~��z��6۽r�\�]��W��S��ng��Z��:��a��6��@��/��1,�rn˧j��6;͡Z�S��i�U��>'�]�i�NY��U��3��R�!�\?�{��_��n��̋�Q��ހ�Ym�)�o��`��O7��x��Rc��i��T�9�n=��.��>)�R-2RR*��9�蘥��Z��\��,�+�8�j�v.��2?ZM��s{�~<[W��d:W�A?5-Ο*�3��r��J��#��%��,��ЙR��S�5dY��A�mPV��\aHf3�"йF`��5�n=l��2�c�qY�ק�A�|rrT��s�.I�ۨ�٫�a�]�˚Z��M�nmj��b�M2��0�� v��t��+�+Tm��M��*��岜�by�5�ouNX(+9S��t!S̈(Kw�Ǐv�8�֚��t�ȱ�5w�zN�J��p�o5��|ņ��lqM�X'k�e�Фb moӅ�ɸpj�q�0NR��s��/b�[A(�:�)�db", "�L��0s��^z��z0L�O�r�K�ߞ��NMD ��̧3|�_5�t��(#x̤�d>�]<ư��Q�r}A�J��Ug�6kұ$C��J��]c�A]$�N��K��,'s��5(]�G��ϔ��eBrI�!�ܚgGa��J�y��tfXoQ�k�`��L�MW��v6�lO��>�ܪ��i�x)+�b))��;mPV6F�$�0h!1#(�]Z[hd`ߨm��(�`�Q�q^��5"b�_��@O�F�f1H�v�r�:�S�A�*}��L��a0�mh�g�4��,�c�Ҫ�RRS��5��/��+��؆fR=�~� ��20��II�m�<��q1��E��"/�U#۽y��ؼYN^��Xo`5U#��q�6YbCe��.APPLb�as��J�Ji�#O4��9)�mn�0(Ŭh��BC�Fs��P(�o�<��r��{�7WMZ��1}P��Y�]m��d��5��l��1�X��%��κ��#)5jh��A��p��`�u;�r�n�uت9P�j��^�`m�i��:�;��չ�Y�6Y�ս��n'�T��j��[��=gc:�O9+��_�ƵZ�]n|xN�T��dxIkP�w�{p��5F�8w��N��H�ωA�cEV伬��rR��J��b�mϙ��9�7��f�&�F�Vl��;��P�>1�v@I)��Q��(}$�G W��q�b�k�S!�@��}��}�~��7�GD��RSK�}E(�GX�V$��F��F�Q[[��⥍k�`UT�@\u��uճC�oQ�(��"��\��dKyEJJ6�:��6L�k#C�& �/�Ό�*�Ց洩ؚK�rRZ�:s�c��U�{��,��j�ێ��6�-��݅M,�/ƑD��#�Xr�gͤ�h�pKJsb��G�|�(G��ͦ�͈5�xpl=��mK�²��^��*C�NM��E��H�G�.��iS�b�� 6ïjx�q��K�_�&ea��w�M�U�Ea+E+aN4췺� �f%�&��@�:,�h(��a wL��uÓ;�f*b�b��Z��4��{�9��`�i�X'�ŧ>3��Z9��v�$h�iemݩx��C��D'cPdc�P�bV��B0v4��d�&Q�MD��aL��R'J��M�/��k�éD�o(��b�M�qф!��up�ڌ88hMF.�g6:�M-H%��,GD��{��!�`ڬu�M�O�`A\mA��n�Zkڴ�]��`��G�1U�h*��_��.hi�htB6��(��oD��Hw�1F0DV��t5$q��)2M�^��-m�V*��A�9", "�Zɘ`]]..l�C�H0H�\��9��!v>�o��aM�!�n�`-FP�2$�ތ�>>{0ړ��L��7<1+�)^v�Wұ��X0mF��Vnu��B!ԅ��5��]�jT�7P+�Ee8�KJn};��UM�$�g6'e��0�^��+��(�!�ò*��M:V�d|��l��~��de��C=nu�Wd�5��:ؑ��炩��7�*�Ć犑�z-��~p��#0�n:`v�ք��a��D��;2˯] ��3[�%�l��G$�A��h6֎4z�N��A"��F�;��:"��6�t��3��s^li�ȑ�v��\��/9G`kr��pF�F��@OHG!�Iv��q�6��y�>��ulSZ�K��w��@xB�YdD��c��t�z�#��s2S,��HE-.#�uꁶ��c�~[��Z��PzNf2�h�[�t��I�V�XY�P=�h��D��Nt��7��\��d1ߧbYA��,�r�k��snCd!CI~�K�g��nuD&��Z��f�@�Qf/��j��J�q��K�I�q��s� ��,�wW��.h(��.A��Z�e��)��y��[��ޯ7��H}��Lx��Z�OI�҇/Gɿ��ǿ=��PQ߬��V�u1��=Y��G��?��)}��nZs�b�|P�+�[��"3��%�A��>��(��J͠��(��A&dk��,�[�w�~��>�lĆ�pX�I؅��7�EQ��>" "5�}\X��Յ4�N>��_l�pX��TC��T_7��"��4�M��L��GMq��a�U�+>_GT��p0F#�F�}�L>b|㚆��&L.3vu�R6)��l�*�NƔ�&�ҍ� �#�+ NE�ЍO��>��²�Y��$��&X��W4?�%�8ܛ�C]-��t�Dj�:��`øO=��CǮ��/҆��o�X�`.�l˂I�$) ��i6>�=�xV�lD�;��J�bÎ�ǵAPD-i�!1�ba��_O]��h�lb]_n��.��)��｣�N]�zl�L)#O��U�� -0��*��V��@�5y�c��.R�m1O�ĺ*r�W?��d��=�QX��ECg��V�p�G�*�.�X&�<�E�ͺ��ә��G�*}4�3��+d��yȕ��G��M!K��m�U��ߌNE�� C�^o1��`<��-�9�scX��m��B�G?a�?"�"��T�q#�c!:A�p�Aڛ��='��ƨaHǐ�%�<�'��%t�g%F%�\/XL1D��x-ks8~�^�p )<��Dģ�*�l��ɲ��0~6��"~sT�Z�� PRU~�@X��2��@ f��1��2<��W��C1��~;Y2T��p��b�M0S�k�Z}��b��%�}0A��sR)��;�Kْ��Mw��3��x7-�X8�}l}��~^X&J�|��EU��!`r��%��jv��s�(��e��1��O=>��L�{�#�r؝c�$�Zi�<�8��4�-d�\�9��Z!��?��Q��s��VWg7�%�a��e��,-��e˷��b�<_��O��7v�,�舩��X('z�|��" "�ʃ��|֞]�q��ϳr�_>S/M��VN��H�{�n��E٬b�l��L�^��<�,�Ʌ7�+)��Ƨ��Q��j��l[��F�]%3`�e��U��d7��\�;��/V��3($�s�v�c��)SG~�mRz��4�d.6�Q�Y�DKU�Z�#��aZ�v�K��l4�oT��f�7�`��,�[�1�=q�=C5�� 0��Tk��ഝ��!;c)5�u �h��QM��Kuy�$ϥ3��,rXϙ�O�۟��BYa�U��R��g��Y��(H�޸t��ۀ��x��m|��i��~>>�l�H�1$_�/9��π>��ǵ��R��3��ǡ��1j�0w��'��U��"��P��P�VJ�ك��z�sS�Ol��l�P�r%F��W�!�N+��RI��Q�v".�£�bG�U�>��l�<�Ur�+o�ȃ烈E:��1�8��SeUVqCZ��;{�B�w�ԄEG��l& �DBf��1��9D�X��Z��ӯ$�4�� $��j�WZ�k��p�j&��3��&��&b]�ǉ��sȧ_Y�{�Nb��b$}҄��;�p`v܄Pn �:O�I&��N�A�_Qp�� SiE�(r��?��5�>��2>��<�L�!�tĿ�r~�zďOz�h�f=��Mv��a8�+0&˄Y�8%��e {��jF�V��`$bE��.VJ��F�K?��#g>��<*(bG��tBU��ń�K?�7�\�<�0�1S�jYp��JB��;��8y��~��pź�-8��&g��O�B'%��P=��c��}si�:8�<1��7��&�7ȴ?��0�;�p`�j�ɉ#d�^�H�D��dHqZT��#��'RZ�s%)~�`u=�\)>/�1=��-�S|w��w�gg߫��ਬ�ѧ��{�]��$Hq�a�5Bx��z�O��&�v��Y��ºjA�D9^��`]��<3�<��A�?͇�jc뛢��^ИX:�H��¾̊fNZQrA�5��i¥b=81��/�D��Ws�|>�f��z��/^%5�cJ"��F��s@�HP��I��D��M��cv"աA��=�N�D�W��܋�G}}4 �'c' ��@#8��L�-��׹e#�YP��J�M6��0��e~�B�k,��g�aDZ�9Q�uqQK�S�d8��@0[�+a�.ݴJ��F��Z��ڊ7)��a�D�8�\��H��xX�``��|X)��zB�)�ʟB��&�Pk,�+V��5%�m�" "gbq��M&��h3��春ķ�.N��s4�sj�e8�Y�ԠlB݄�-��8-�6m��'�^�f|��|%��1?��|�(��W�'|�ÍE>�}�2�\nu��R�;6�W�-��=�Uy�'�~�+r��t�MA��ƛE��6ipw׽~��]5��=E��䮙��ݸv��,F��p{��_��]S`k�n*��'�"��M�Xd&�A)l��J�뀢�SP��W�Px�E7!��O{�x��(�t�P�3�P�S��ߢ�8�4;��nM�L��E�;9�l�a��^�sh��ֈ�3��Q�#x��\b8��xHxh�f�Q[e�3��Z+��^�t��"��BaRT��\�>J~��4��E��#5�v|%��p�~>��迂O�t��Oʋ|j�[q��`�Jx }��oq²��P�~�=M�j��ۦ�u�K�ȹ��|l��N�B��?Ё��o��` |��@��!z��׈�6�c`�E�M��?��O��~f�6�=�̲]��fm��:fe_dV�2כx\�*=�@��ÿwx�C��#�!q�Wm_��m:^Ǿ܋�k�� Ȓ>�?�O�iFg��ͨz�1ۦ�u|ʿȧ�0��_�/?�'��w��Z�|ڦ�u|*�ȧS�L�S{��M�KSrH~�%rJ��k��m:^ǥ�\:#�N�O��?��w��O��?��)~=��w��R�{��6��W�E~�#�!!}��_�O��69��ːS��n~λ�^GJ�d�:�K��i��~�ב�7�C��t��[�!��>�ziR��x��E��u\�Ӊ�0w�/eg0Ġ $�%�Ѧ��U!5��m��Sb��~7��A �7�+�sk_Ank&�u�]AΈ�\0��OR1{rb%��Ę�0�&}�K7��غ�$r��L�0דϩZ�YHP�M�M=��)��&O܍`��k��'lҧ��܁��M��J�k�c*}��v�LqW��=mjCDQ8��BFI�z��8|s��%y�#��)��`�c��@Bs��D;j�=��h��H|��1+�w��6\Ӄ `�J��+��5�G�9�/��pv��盼:��*��p��.�y��ݣ�v��n�h>SH�99-Ŝq�Mp<�RsW6dP�b§k�C�C8b�It�K�ٹ��&!�7ɇXQ�8��f��`��ݖ��:q�|��h~c��A^؋O�'��7��XPy�Km�Ė�N$�-h��r�)��_�"��Hh�^1~f��n�S�)��DZNgv�ľ�7�St�"��6��l�]��/Y�&d��v�9J处�s�ѿr~��~�±ų� 6��>��_ܸ��ϊ�\:�/��S��ô��jx�b�)t:�L��Me̯��{��׷��޿��V�f�Bq�|�N��\W�ϥ��7�eJ{ۤ��K�v��צ(8��6Y� ��6E��lO%��r�l1��Y!S�� }NJ��8��$ޕ�ߎ[��>3�%�=��z��Zp��x�`?��9)��W�Y:�gKp 0?6�ǅx��O��\��O˳�hַ��/HLJ��+g��v��߮ӵ�i��}{^̛��{��-y�]�O��}�]ǭ�m>�o�M9�V�Q��q��p��ynynҐ��*��-�n��T�Z--�^�{��F[�M�:�S�G!w9�̝9��އ��q��<<�yP�\V[��y�M��tܧV��Q;_�|��\��]��Yw��w[."��S��5MoV��n1��)�� .uHy��U�kT�<\)앻E��_*��{��q��]}��}�[��q�u�u��|�w�M'6|�Pr��r�B��{�p��iY�{��B;�5�U�3j.��t��t��YpC�Mt�c?6��3", "��݇}��ª��q۹��FU��>�c{��[��E�Ѩ8��Bu�:{�*w��ۇoE��3��y鮪.��*�YN��V7|�s�U.t��|��L�s7�.kL��"O��za/��bu��D��_��w�p�^��8{�w�"k5Z�Ŋ�}�'�ޯ��q��4:g�9��P�}>-�r�� \*g^��td�7[��xjv��CsvoBK�/o��>��5��j��>܃�ޞ�;�ވ��n_ʥn[��p+vVw��s�E��<�x7�M��wy�zgy�e��p/��]/�f��M@�q�{��{��GG��2O��Eo�cx�o��鸙_7W��w��`ϕ��/Z�re�>g��g�:��>��w�2j�z�.5��p�f��e�=p'�,_]��ó�k?�<�W��K��na��c?n��5h?>��A'��\�]̀�u3 ?��^�Xɭ�5��bkzg��2v��H�S}v��B��-��!\$&��X��^�է��jݾ��ݾA��3�h8(��k:��4�y1��P��n.o�O{�ࢯ��i|��dT��i��~idy��vT~�H�̒�4.��xAh�u�ؿ��n��m�u�ݯo�cz}t�tT��]uz^��cړry�.��k��m�t��;,��y��ޮ��p>}Ȏ�wW�AM+�cG)}��t��-��=��څ1m4�ё]\T��3�q�#׻b�j�l�r:s��=4�/��`ë�5z{�s��v[�4M��|�ӱ��H>D��>:��e�|�.><8��>e��ji_>��6��E�ť ��S�Qs��Q�A]��s�?��J�r� ~��e��6��lo�f:B{��=� 3�}�G�fqXy�/��MZ3d�le�y�ߺOyEj��D�v��20s�3�N�۽��o��ϯB1�k�ܻ �lr��]��e��2�8��qī)I/.��Y tt��~��\�e�}ꊸJ>��|5�P�"�8}6ge՘��]��7{q��c�Ώ��]k/?��>d��"$c�f��>�ܸ�K6��+��Q�O��(��x𘡝��P��m�ϳ@x#{�?��煽,��C=�y266��l��6�K��2��7��9��8�/=v�7��|�[�-��,/H��a��,��wq��8��^��ݖ�Q��t��-��Z�Vu��е��|�aYm��p\͍�s�wXr�S��|��tZ`� �g��O�W�6�ǎ��ܑ��ȯ��Y~ʠj�", "��^v�F�q�v�Y�`��Ur��q>��T�j�);.?��h�Ƣ��t~�r/�e��خ��r�v�a�9me��v�t ��-�ZR�G��F:� f��a}��(��FM|�.�Y��^��p^lf��v��v��ں�`�{��[:�I!��}g�7��{o,��ۧ�k��Ԫ�q�J�>*EM��aU�xO��.s�ݧ��-�Ewn��VʺS��6��g��W��k��ٷ;��߄ݧ��Y/��t��YiP�6�vE��.�ڛ �m��.�-ʏ�'gv���y��ǐǍ�*��ǽOi��1�Ms�{��G8=�M6��Q��ҍ��U��j�7�[�~�1,tv��Z�mg足�6r]��;�yc��ii��6<��\&�?��P��_�O��t�(�>)��樢KQR|��f� ��G�Q�t��5)��$\�6�1��u<�`y��l�AVr�� [8x��m(A�o�q�F�ס�|�gB��>�.�n`��;ZF��B��8�w�g�vA.m��M834��z�/��5��^�~Pֆ�.ᓀ#r}��N�"nFS#"M��N�}��0�6�� 5Ny@o|P��(=4J�|�@%%��z^ʫlq��0^��b�s�f��`��7�.�Iٶ�#��|r<��-w�6�4�� H��(Q1J׎sh�`�Q�_�z'&t��JL�R�䴤��|%8��(�+J��N��nMdE�?Q6N��D"q��5��dND�Q�@��qL��Q@9.�A��qb�Q44�MƢ��yD�`Y|�A��zsD��&��D��Q�a��O� 8�8��~cBF3��ڞ��L��K{�i��_�#A��5_$x��EBT�V�<ۑo��KN��<��{z��%�5��3��t�&C��<�g�J�S�ܺ�!ݭ��\��ܐ�S0�׳z@�`��^M��T�%��F��A��w͈]Jt�|GB�K�E��{&�nQ�ya�s��ӿ�wvqtߢcv�Y��"?�;~/��z�� ;=FMzssS�."�#��p\��yLU�v�c~a�˽�v�R�l|;�C��x�5�?rKǺ]��QY�̺]�k&��AE��%:�7Y�b��M�M1��N}׼�uƿ��ܥ+#��G�x�??��'ҩoѤ�ĎFl�W��щ��#�l�,}@~�� ~�u�׏S�K�{��۷��w%�'Ƚ8�"��;��M9<��N+�1�S7>�:�G��8&$�2��l��"#�|�NI�Ǉl�$�m��"]��m��--��|��!��a��F��"�j#�i��vm��~��\��uKp�"f��a+a�dP{�m�X�9��#�>:�A:K\=��B!��Z��8|�f", "��p8�י��-��[�OmL��pr]�i�@f�I:�@�g��R}��Kg��n'�J��o��}G��]��V��9Uݻ�N=W��䩻TG��S�o�XZ?96��F.�ǽ8M6^�-M��z,�l+B��E��M:"p=��s2�/S��_�H*?�NE�bq��6E�]�I��ɪZ|�B嗚��.�\��֬�Mg2�C-<��y��j�d:�r�͏��l��D`�w��A��S��]�e�k��H�k��+\��Kd�+إ��:��.��a^׸�.��QN�8�v��O*��g�P6ìM�lP�#n6�w��o�G��a�5��"�g�.A��S��#��q��ǆo��T��!M?_�Q�F�[UK��`<�o��4aׇ}{�G�c[��T��b�3R�DL[%�t,)�u��2hQ�?!=B��d�@cl�yb��I�j��A_��|��HƸ��v�ֵ� ��F;�O��/`�~�� F1=8��߄nр\��.ި��E�p�>��*�jD�٠��Ґ7��?��b�1\��c��7ϮaO�^�-��칔�.��q�k��/ƪ��ͪ��I� gY9ϵ�%��1��:;�t�H�r�.R�B�M�q��o��6�ͮ�ܪ�5��̭�$_ؾI�7��@�D��e��L��b6�5YV.ic]�k�B��Q��lV+�J>S(dQ��9ë�.!j�W΍�X��kU+C8K�snO��UBU}�??�X�a�6`B�*�\��f�mޜ$q�:�$��#4�ϟ�'�s�PXb�]\�o֤c��ex%��cɗ��!.ޅ,��2Bė�1�i\�K��v��6�7anI�&��8�+q��p��Į��^��u�!A�KT��]li��㏹��xo��k�h�)��", "�b!��_��g��[�{F�RXh/7Ԟ��Hr��o�u�\RAG�G�{��gQ�<�kj�HҰ��s�|[��c�ݢ�X�I��t�8�1��[��_ud��G]�?��ĚD�� 4'b��=�[n��~8��.��}`�_C.�pp4�.�؇��>�t��Lz�ƍ��R�^6��anl�W��Z��<�Z�RF�Z�Jߤ��y��+��Y�@ΉďF�S��?��_��φ?��-��l�/c�k�s��#��1��\1�ʲ]�{��_O��\襄��H��ީs[��!��j�2D��C�R+-68J�׹j��/��`��b��O��77�kե,�_7N�m⫕_t�M8i?H!$��P�~�ߤ1en~�s��o��)�M�uT�@��h�åbA��0L��Z?Y4p�<�^�x�is��^�B�1>�E��G#<�C��n�12��vlj9XJZ@_�~��h�"�Z�$|�O��8�_bikQ��-��!�E�b�0&�]��7��$��)r�4�U<��v]�?�Id�s�%��:�>�6��ؑ��k~��?��oҼ>F�8ؑ��M��0�m��IzY��$5k�BF)�9]��ҥt&[�+�Z��", "788�]�o�6�_��!�~Y��ڬkҥh��Ċm�%�&i��}��e�N��a�C_y:R��x��{T��u��~��^��D��%nͼ�M��&!rA��Fպ��%��X�Hw?9��yv$�o��K��v.��e�ά��!l�?��@kV��l�y��4��'�#��w��?"a�#��3f3�|��jw��o{MU&��2�� l��Z��Ղ�c��bV�7�Cic9�ԛ��眡��:#�6��>��(�g�"�~x|��.Nޝ�N��g�ŹI�wLL�J��i��E��>��[�93�f�ΓR��h�hdݰ�K�Hh;�� !�*�Y��GǨY��l�RC��N�ىEy�=?`��3b"�RE^q(4H�'�>��I�O}2d��!�ިG��@�?�X�C�y�HW��ے.�b`I��^��do �!YC;�!y��'C+��`��_�.M2��V��Mrv�K�)��IM,X�9gi�w�R��c7t��I��Y�I�5�b0�E�qf�<�M�9v��n��CѤ��;+�45ҍlj��z�U��H�y�`~>>Fq,��|��&X_9��)�t��Ϸ&��V�l98�^��W��Q��8��Y��r�_ӨqǔQH��9��Vzߒ�ѵ#u� $�}��,�ٴ/i��p�|�_��,OI$��H{�0�7��Z78yy8��E`��iU{wr~�结G:�6r`��NA^k��{ZU�觭\1U�6W:[�Ĩ2Ore�zX/�m�Ƥ @d'��H0u�M�N��:�$Z��59gR�rIɭ�*�o��I��ݰ��[w��щUid�m��k��n��Yj\wk��E�T�ܹ�r�p4s��'��ռE�9%J�|Q�Y4�+֍|=Άp`���3�j9˓\W��)��>�m?j�mu7K̐�K��FZ��<��l�P%��-��)��C��6K��;];r�p�L��9�t��|_Dbț��s��V4�:Wx�&��&��kv"��lF("Z�jJ��e��˹T�1AS��F��n�/��r6{��(�"P�[(�l��Wl5�uu��v ��o8 �y^�R�T��%�ҘK]�΁��w*5��`�+�{L��BdL��=��?�8�H_�u��i�Y?�M�\��!9˰Zղ�C�9<�'��8q�b§I�B��O8�xm^�y��-�x��/w��lޖ�9�|�|׻�b��xD�s��Ec��M�?��", ")M��X�Ou��!�#��d!vJ�yfMَ6|�1jF��^��&I��ښ^:%Ah`��u-��!1�&��f�V�s��N]7��ηX�3F�;V�ˉ��1��l��]�&��@�K>��G9=F՗E=��h��_�"�u��-��\��>~��z��t|��Ex�0�B(�s�-�}��m�6�Y��5y��L��B=�E<��#XP�ժ��q[�p��(��c��;��vQo��}o��bMm\H��aDmm��+滭��E��U��m��[�j�6�j�~&��qDfO��;zԝ��7uǑ�X}��4�� /&�|��" "a��~��0" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�0000001�e2PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comCookie: __Host-GAPS=1:xm1C299emNhBxE33z8RyDy0OMHWL_g:rd8uXYJWZNu1Y4xaConnection: Keep-AliveDNT: 1", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3bKHTmWaKGIxkb6-797dhrOBCNlWq7OFJ5u9U_F6VoGXNY-jRsPWOYEOhjpPGBG6rZyeC_hQ HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:-pApEK-WsNcBBbdFwn0mbal_qTjPIQ:CdMKsjHW3eOFVjeq", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2KDBdut779DRp_4H2RZRG7ATiFxOko7NueqmzNK5-Ll6KRfMebrkfYQzB7G_t0eS_GUORCHQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S923095847%3A1703740645370960&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:-pApEK-WsNcBBbdFwn0mbal_qTjPIQ:CdMKsjHW3eOFVjeq"74:T14e6,Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00001760.00000000.67876.02350000.00000002.mdmp") Found URL "http://timevalue