24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 93:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T46b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 44ae5bcd4f1e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 44ae5bcd4f1e…. Malware family: Malware. Threat score 100/100. 6/25 AV engines flagged this file. 21 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c"],"about":{"@type":"SoftwareApplication","name":"WEXTRACT.EXE","applicationCategory":["peexe","executable"],"identifier":"44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":21,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4aa,"WEXTRACT.EXE" called "FindResourceA" with parameter "19862136" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862144" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862172" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862384" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862200" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862356" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862368" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "15202440" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862252" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862348" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "15202436" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862216" - (UID: 00000000-00008164) "WEXTRACT.EXE" called "FindResourceA" with parameter "19862224" - (UID: 00000000-00008164)26:T610,"WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908736'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908592'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908752'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908640'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908608'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908656'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908704'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908576'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908688'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908720'}" (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19908672'}" (UID: 00000000-00008164) "1PZ89wW4.exe" called "LoadResource with parameter {'hModule': '15138816', 'hResInfo': '16008488'}" (UID: 00000000-00000416) "4ZM853ko.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13279416'}" (UID: 00000000-00006424)27:Tbdd,"WEXTRACT.EXE" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00008164) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\CC (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Autofill (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\FTP\FileZilla (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\FTP\TotalCommander (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\FTP (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\Growtopia (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\Minecraft (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\TLauncher (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\FeatherClient (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\LunarClient (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\Battle.net (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\Steam (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\Skype (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\Element (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\ICQ (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\Signal (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\Tox (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\Pidgin (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\VPN\OpenVPN Connect (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\VPN (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Plugins (UID: 00000000-00006424) "4ZM853ko.exe" called "RemoveDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Wallets (UID: 00000000-00006424)28:T5f5,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "WEXTRACT.EXE") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "WEXTRACT.EXE") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")29:T8fe,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "WEXTRACT.EXE") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "[InjectDependency] WriteProcessMemory failed6" (Indicator: "WriteProcessMemory"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")2a:T7b7,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt32" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt16" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "4ZM853ko.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "4ZM853ko.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "4ZM853ko.exe"2b:T8b9,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "WEXTRACT.EXE") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "WEXTRACT.EXE") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "WEXTRACT.EXE") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "LoadLibraryA(" (Indicator: "LoadLibrary"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")2c:T8a6,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "WEXTRACT.EXE") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")2d:T180d,file/memory contains long string with (Indicator: "HMAC"; File: "History") file/memory contains long string with (Indicator: "HMAC"; File: "n4y3o5MrYEYdHistory") file/memory contains long string with (Indicator: "Oid"; File: "f_0004f1") file/memory contains long string with (Indicator: "HMAC"; File: "000003.log") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp")2e:T6a2,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to cryptographic keys Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2f:Tece,"WEXTRACT.EXE" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008164) "WEXTRACT.EXE" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008164) "1PZ89wW4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000070300000000000000008e22914e00000000000001017e00000000005600b00d5600000e5600207707030f00000070f8bf00010000009e298377a8e2070300000000000800000008000000000503b8f8bf0000000000500000000000000000000000000000002000000054f8bf007f21ea00886307031463070302000000000000000d0000004cf8bf00bb2fea00f80df40088f8bf008e1eea00020000007e1eea0018307cd002000000a0c8f0000d000000000000005cf8bf000000000040f9bf00202de900584230d0feffffff7e1eea002d1fea009cf8bf00b8f8bf00a0f8bf00020000000200000000080000c0f8bf002022ea0002000000b8f8bf00 (UID: 00000000-00000416) "1PZ89wW4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000416) "1PZ89wW4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000416) "1PZ89wW4.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000416)30:T119e,"WEXTRACT.EXE" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007d2973f89208010000000038f7e70024472973f892080190f7e700d5272973f8920801010000005f3c42ab00000000d2f3433a000000000300000044f8e7000a000000800f000088f8e700c0f7e7005d0000000300000048f7e70050f7e7005cfae700505929734fdb8ed8feffffff9cf8e70047f22773d2f3433a00000000 (UID: 00000000-00008164) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e00660069006700050000053f0e000008fd170308da17032e0063006f006e0066006900670000006c006c00 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000e8140bb71683772208000030080000cc9517039ce8140b8009506f000017030000d700300800000000000000000000060100000300000000001703220800000000000020000000d0e8140bee13837700000000ee13837700000000000000002208000000000000ece8140b76fd23760000170300000000220800008009506f (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000028121d0500001703338a23731800000000000000000000000300000002000000000017030c0000000000000020000000cce00f01ee13837728121d05ee13837700000000000000000c00000088e9450a00e9450ae4e00f012823887200001703000000000c0000008c8d7305f0e00f012f99376c0c000000 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001703000000001800000000000000000000000300000002000000000017030c000000000000002a0479b134e10f01ee13837700000000ee13837700000000000000000c000000ffff226cb4821f034ce10f012823887200001703000000000c0000000832376c58e10f012f99376c0c000000 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001683770c00000000000000000000000000170370e20f011800000000000000000000000300000002000000000017030c0000000000000014e20f0118e20f01ee13837700000000ee13837700000000000000000c0000003063331730e20f012823887200001703000000000c00000030a5376c3ce20f012f99376c0c000000 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000028121d0500001703338a23731800000000000000000000000300000002000000000017030c0000000000000020000000cce00f01ee13837728121d05ee13837700000000000000000c00000018f0450a00f0450ae4e00f012823887200001703000000000c00000048fa7305f0e00f012f99376c0c000000 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001703000000001800000000000000000000000300000002000000000017030c000000000000007a0479b164e10f01ee13837700000000ee13837700000000000000000c000000ffff226cac3120037ce10f012823887200001703000000000c0000000832376c88e10f012f99376c0c000000 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000028121d0500001703338a23731800000000000000000000000300000002000000000017030c0000000000000020000000cce00f01ee13837728121d05ee13837700000000000000000c00000018f0450a00f0450ae4e00f012823887200001703000000000c0000000c107405f0e00f012f99376c0c000000 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000001703000000001800000000000000000000000300000002000000000017030c00000000000000020479b15ce10f01ee13837700000000ee13837700000000000000000c000000ffff226cb4821f0374e10f012823887200001703000000000c0000000832376c80e10f012f99376c0c000000 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000028121d0500001703338a23731800000000000000000000000300000002000000000017030c0000000000000020000000cce00f01ee13837728121d05ee13837700000000000000000c00000038ee450a00ee450ae4e00f012823887200001703000000000c000000401b7405f0e00f012f99376c0c000000 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001683770c000000000000000000000000001703200000001800000000000000000000000300000002000000000017030c000000000000006ce10f0158e10f01ee13837700000000ee13837700000000000000000c000000ffff226c70e10f012823887200001703000000000c0000000832376c7ce10f012f99376c0c000000 (UID: 00000000-00006424)31:T4dd,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "WEXTRACT.EXE") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")32:T4a5,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "WEXTRACT.EXE") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")33:T40c,"WEXTRACT.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WEXTRACT.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1PZ89wW4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1PZ89wW4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")34:T87c,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "WEXTRACT.EXE") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetCreationTime" (Indicator: "GetCreationTime"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "GetLastAccessTime" (Indicator: "GetLastAccessTime"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")35:T635,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "WEXTRACT.EXE") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "WEXTRACT.EXE") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")36:T4dd,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "WEXTRACT.EXE") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")37:T481,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "83162779620,7700,100,,FindWindowExW,user32.dll,"00:17:56.984",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00000416.00000001.68942.030C2000.00000004.mdmp")38:T987,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "WEXTRACT.EXE") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "WEXTRACT.EXE") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "WEXTRACT.EXE") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "11856802777,7620,3024,,RtlGetVersion,NTDLL.dll,"00:17:27.265",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp") Found reference to API "76928448803,7416,3024,,RtlGetVersion,NTDLL.dll,"00:17:54.390",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000416.00000001.68942.030C2000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")39:T931,"4ZM853ko.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "SEARCHLIST"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "NAMESERVER"; Value: "") "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "")3a:T579,"4ZM853ko.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe" at 00000000-00006424-00000C15-102832657 "4ZM853ko.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00006424-00000C15-104714746 "4ZM853ko.exe" queries volume information of "C:\" at 00000000-00006424-00000C15-114505564 "4ZM853ko.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00006424-00000C15-136928401 "4ZM853ko.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006424-00000C15-137984771 "4ZM853ko.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006424-00000C15-138047403 "4ZM853ko.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006424-00000C15-138047598 "4ZM853ko.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00006424-00000C15-1436180983b:T898,"4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "4ZM853ko.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")3c:T4f7,"4ZM853ko.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3d:Tb2f,"4ZM853ko.exe" called "CopyFileW" to copy %TEMP%\IXP000.TMP\4ZM853ko.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %TEMP%\IXP000.TMP\4ZM853ko.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %TEMP%\IXP000.TMP\4ZM853ko.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite to new location %TEMP%\tempAVSiCR0qs2iDTrY\VkKdGaR80Ut2formhistory.sqlite (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %TEMP%\tempAVSiCR0qs2iDTrY\hz1eMNOGAR76Login Data (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite to new location %TEMP%\tempAVSiCR0qs2iDTrY\xGuAyDSyW6Edplaces.sqlite (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite to new location %TEMP%\tempAVSiCR0qs2iDTrY\QmSgZSSgpbKNcookies.sqlite (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite to new location %TEMP%\tempAVSiCR0qs2iDTrY\eycuZ3En43qcplaces.sqlite (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\tempAVSiCR0qs2iDTrY\k8UyqcMwHIGAWeb Data (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\tempAVSiCR0qs2iDTrY\51qcDnIEmt9uHistory (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\tempAVSiCR0qs2iDTrY\KoZiiAToNt1zWeb Data (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\tempAVSiCR0qs2iDTrY\mKJFa4UOJFcKWeb Data (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies to new location %TEMP%\tempAVSiCR0qs2iDTrY\KW4TafHVowS9Cookies (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\tempAVSiCR0qs2iDTrY\n4y3o5MrYEYdHistory (UID: 00000000-00006424) "4ZM853ko.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log to new location %TEMP%\tempAVSiCR0qs2iDTrY\2r793jXbpERi000004.log (UID: 00000000-00006424)3e:Tb9d,"WEXTRACT.EXE" called "CreateDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00008164) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\FANBooster131 (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempAVSiCR0qs2iDTrY (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Cookies (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Autofill (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\CC (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Downloads (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\FTP (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\FTP\FileZilla (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\FTP\TotalCommander (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\Growtopia (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\Minecraft (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\TLauncher (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\FeatherClient (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\LunarClient (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\Battle.net (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Games\Steam (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\Skype (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\Element (UID: 00000000-00006424) "4ZM853ko.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMSiCR0qs2iDTrY\Messengers\ICQ (UID: 00000000-00006424)3f:T39d6,"WEXTRACT.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00008164) "WEXTRACT.EXE" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00008164) "1PZ89wW4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\1PZ89wW4.exe (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00000416) "1PZ89wW4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00000416) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\sqlite3 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter sqlite3 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\ntdll.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\Crypt32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\setupapi.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\winbrand.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter winbrand.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006424) "4ZM853ko.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006424) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002644) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002644) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002644) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002644) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002200) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002200) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002200) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002200) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004664) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004664) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004664) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004664) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005436) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005436) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005436) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005436)40:T1106b,"WEXTRACT.EXE" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00008164) "WEXTRACT.EXE" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00008164) "1PZ89wW4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryBinaryBlob (UID: 00000000-00000416) "1PZ89wW4.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00000416) "4ZM853ko.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FindResource (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetPriorityClassW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreatePipeW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetCurrentDirectory (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_errstr (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter VaultFree (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter VaultCloseVault (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter VaultGetItem (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CredEnumerateA (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CredEnumerateAW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CredFree (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CredFreeW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllBidEntryPoint (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllBidEntryPointA (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _DllBidEntryPoint@36 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllBidFinalize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllBidFinalizeA (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _DllBidFinalize@0 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllBidInitialize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllBidInitializeA (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _DllBidInitialize@0 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllBidCtlProc (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllBidCtlProcW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _DllBidCtlProc@24 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_open_v2 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_db_readonly (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_busy_timeout (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_total_changes (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_prepare_v2 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_step (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_reset (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_finalize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_close_v2 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_column_count (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_column_type (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_column_decltype (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_column_text (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_column_bytes (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_column_int64 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter sqlite3_column_blob (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CryptUnprotectDataW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentHwProfileA (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevs (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfacesW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetail (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter BrandingFormatString (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter BrandingFormatStringW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RemoveDirectory (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006424) "4ZM853ko.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006424) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002644) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002200) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002200) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004664) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004664) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005436) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005436)41:T1968,"SELECT * FROM Win32_LogicalDisk WHERE DeviceID = '" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select * from win32_logicaldisk where deviceid = '") "SELECT * FROM Win32_Processor" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select * from win32_processor") "SELECT * FROM Win32_PhysicalMemory" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select * from win32_physicalmemory") "SELECT * FROM Win32_VideoController" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select * from win32_videocontroller") "SELECT action_url, origin_url, username_value, password_value FROM logins" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select action_url, origin_url, username_value, password_value from logins") "SELECT name, value FROM autofill" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select name, value from autofill") "SELECT tab_url, target_path FROM downloads" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select tab_url, target_path from downloads") "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, origin, billing_address_id, nickname FROM credit_cards" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select name_on_card, expiration_month, expiration_year, card_number_encrypted, origin, billing_address_id, nickname from credit_cards") "SELECT name_on_card, exp_month, exp_year, last_four, nickname, bank_name, card_art_url, network FROM masked_credit_cards" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select name_on_card, exp_month, exp_year, last_four, nickname, bank_name, card_art_url, network from masked_credit_cards") "SELECT host_key, is_httponly, path, is_secure, expires_utc, name, value, encrypted_value FROM cookies" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select host_key, is_httponly, path, is_secure, expires_utc, name, value, encrypted_value from cookies") "SELECT service, encrypted_token FROM token_service" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select service, encrypted_token from token_service") "SELECT url, last_visit_time FROM(SELECT url, last_visit_time, id FROM urls ORDER BY id DESC LIMIT 2500) ORDER BY id ASC" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select url, last_visit_time from(select url, last_visit_time, id from urls order by id desc limit 2500) order by id asc"), "SELECT * FROM" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select * from"), "CREATE TABLE" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, Indicator: "create table"), "SELECT name FROM sqlite_master WHERE type='table';" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select name from sqlite_master where type='table';"), "SELECT encryptedUsername encryptedPassword formSubmitURL FROM moz_logins" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select encryptedusername encryptedpassword formsubmiturl from moz_logins"), "SELECT fieldname value FROM moz_formhistory;" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select fieldname value from moz_formhistory;"), "SELECT place_id content FROM moz_annos WHERE anno_attribute_id = 1" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select place_id content from moz_annos where anno_attribute_id = 1"), "SELECT url FROM moz_places WHERE id = {0}" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select url from moz_places where id = {0}"), "SELECT host isHttpOnly path isSecure expiry name value FROM moz_cookies" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select host ishttponly path issecure expiry name value from moz_cookies"), "SELECT place_id visit_date FROM(SELECT place_id, visit_date, id FROM moz_historyvisits ORDER BY id DESC LIMIT 2500) ORDER BY id ASC" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, Indicator: "select place_id visit_date from(select place_id, visit_date, id from moz_historyvisits order by id desc limit 2500) order by id asc"), "SELECT 1 FROM "%w".%s WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d)=NULL" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, Indicator: "select 1 from "%w".%s where name not like 'sqlite_%%' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d)=null"), "SELECT 1 FROM temp.%s WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1)=NULL" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, Indicator: "select 1 from temp.%s where name not like 'sqlite_%%' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1)=null"), "UPDATE "%w".%s SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqlite_%%'" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, Indicator: "update "%w".%s set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlite_%%'"), "UPDATE %Q.%s SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, Indicator: "update %q.%s set tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');")42:T14c1,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "WEXTRACT.EXE") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.00E60000.00000004.mdmp, 00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.00E60000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.030C2000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WR" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "vateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000001.68942.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.030C2000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitiga>" (Indicator: "CreateProcess"; Source: "00000000-00000416.00000001.68942.030C2000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000000.69837.03470000.00000004.mdmp, 00000000-00006424.00000000.69837.03530000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03470000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "ateCreateProcess WRPMitigat" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessW,404,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00006424.00000001.71758.03170000.00000004.mdmp")43:T94f,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "WEXTRACT.EXE") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")44:Tadb,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "WEXTRACT.EXE") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")45:T4a3,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "yncShellExecute~" (Indicator: "ShellExecute"; Source: "00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp")46:T89e,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "WEXTRACT.EXE") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "WEXTRACT.EXE") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "WEXTRACT.EXE") Found reference to API "LockResource" (Indicator: "LockResource"; File: "WEXTRACT.EXE") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "WEXTRACT.EXE") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "FindResource" (Indicator: "FindResource"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")47:T78d,Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp")48:T40a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "WEXTRACT.EXE") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")49:T510,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "WEXTRACT.EXE") file/memory contains long string with (Indicator: "OpenProcess"; File: "WEXTRACT.EXE") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")4a:T83e,"sqlite3.dll" contains export function called "sqlite3_activate_cerod" at ordinal 1 "sqlite3.dll" contains export function called "sqlite3_activate_see" at ordinal 2 "sqlite3.dll" contains export function called "sqlite3_aggregate_context" at ordinal 3 "sqlite3.dll" contains export function called "sqlite3_auto_extension" at ordinal 4 "sqlite3.dll" contains export function called "sqlite3_backup_finish" at ordinal 5 "sqlite3.dll" contains export function called "sqlite3_backup_init" at ordinal 6 "sqlite3.dll" contains export function called "sqlite3_backup_pagecount" at ordinal 7 "sqlite3.dll" contains export function called "sqlite3_backup_remaining" at ordinal 8 "sqlite3.dll" contains export function called "sqlite3_backup_step" at ordinal 9 "sqlite3.dll" contains export function called "sqlite3_bind_blob" at ordinal 10 "sqlite3.dll" contains export function called "sqlite3_bind_blob64" at ordinal 11 "sqlite3.dll" contains export function called "sqlite3_bind_double" at ordinal 12 "sqlite3.dll" contains export function called "sqlite3_bind_int" at ordinal 13 "sqlite3.dll" contains export function called "sqlite3_bind_int64" at ordinal 14 "sqlite3.dll" contains export function called "sqlite3_bind_null" at ordinal 15 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_count" at ordinal 16 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_index" at ordinal 17 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_name" at ordinal 18 "sqlite3.dll" contains export function called "sqlite3_bind_pointer" at ordinal 19 "sqlite3.dll" contains export function called "sqlite3_bind_text" at ordinal 20 "sqlite3.dll" contains export function called "sqlite3_bind_text64" at ordinal 21 "sqlite3.dll" contains export function called "sqlite3_bind_value" at ordinal 22 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob" at ordinal 23 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob64" at ordinal 24 "sqlite3.dll" contains export function called "sqlite3_blob_bytes" at ordinal 254b:T5f8,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006424.00000001.71758.03170000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006424.00000001.71758.03170000.00000004.mdmp ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00006424.00000001.71758.03170000.00000004.mdmp "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk" (Indicator: "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00006424.00000001.71758.03170000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp4c:T257b,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: WEXTRACT.EXE "DSystem\CurrentControlSet\Control\Session Manager" in Source: WEXTRACT.EXE "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: WEXTRACT.EXE "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: WEXTRACT.EXE "System\CurrentControlSet\Control\Session Manager" in Source: 4117-17-0040256D "Software\AutoIt v3\AutoIt" in Source: 00000000-00000416.00000000.67023.00F0C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00000416.00000000.67023.00F0C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00000416.00000000.67023.00F0C000.00000002.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00000416.00000000.67023.03050000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000416.00000000.67023.03050000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00000416.00000000.67023.03050000.00000004.mdmp 00000000-00000416.00000001.68942.030C2000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00000416.00000001.68942.03050000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\AppX90nv6nhay5n6a98fnetv7tpk64pp35es" in Source: 00000000-00000416.00000001.68942.03050000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\https" in Source: 00000000-00000416.00000001.68942.03050000.00000004.mdmp "Registry\Machine\Software\Classes\AppX90nv6nhay5n6a98fnetv7tpk64pp35es\Shell\open" in Source: 00000000-00000416.00000001.68942.03050000.00000004.mdmp 00000000-00000416.00000001.68942.030C2000.00000004.mdmp "Registry\Machine\Software\Classes\AppX90nv6nhay5n6a98fnetv7tpk64pp35es" in Source: 00000000-00000416.00000001.68942.030C2000.00000004.mdmp "hine\Software\Classes\AllProtocols" in Source: 00000000-00000416.00000001.68942.030C2000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000416.00000001.68942.030C2000.00000004.mdmp "Registry\Machine\Software\Classes\AllProtocols" in Source: 00000000-00000416.00000001.68942.030C2000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006424.00000001.71758.04D90000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006424.00000001.71758.04D90000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocolteEKUsponseHandling" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\vmhgfs+" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "SOFTWARE\Classes\Foxmail\shell\open\command" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676z" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676X" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006424.00000001.71758.051D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00008164.00000000.66965.012F1000.00000020.mdmp4d:Td9d,"1PZ89wW4.exe" failed to load missing module "%WINDIR%\System32\Windows.UI.AppDefaults.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%TEMP%\IXP000.TMP\sqlite3" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%TEMP%\IXP000.TMP\ntdll.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%TEMP%\IXP000.TMP\Crypt32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%TEMP%\IXP000.TMP\setupapi.dll" - [base:0; Status:c0000135] "4ZM853ko.exe" failed to load missing module "%TEMP%\IXP000.TMP\winbrand.dll" - [base:0; Status:c0000135]4e:T683,Observed unmanaged function "sqlite3_backup_init" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_backup_step" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_backup_finish" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_backup_remaining" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_backup_pagecount" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_bind_blob" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_bind_double" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_bind_int" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_bind_int64" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_bind_null" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_bind_parameter_index" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_bind_text" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_busy_timeout" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_close_v2" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_blob" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_bytes" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_count" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_decltype" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_double" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_int64" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_name" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_text" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_column_type" in "4ZM853ko.exe" Observed unmanaged function "sqlite3_config" in "4ZM853ko.exe"4f:T107a,Found string "https://www.linkedin.com/login" (Indicator: "linkedin.com"; File: "WEXTRACT.EXE") Found string "https://www.paypal.com/signin" (Indicator: "paypal"; File: "WEXTRACT.EXE") Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "WEXTRACT.EXE") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "WEXTRACT.EXE") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "WEXTRACT.EXE") Found string "https://www.linkedin.com/www.linkedin.comdefaulthttps://ntp.msn.com/ntp.msn.comdefaulthttps://www.office.com/www.office.comdefault" (Indicator: "linkedin.com"; File: "QuotaManager-journal") file/memory contains long string with (Indicator: "linkedin.com"; File: "LOG") Found string "_keyhttps://www.youtube.com/s/desktop/28b0985e/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js https://youtube.com/" (Indicator: "youtube"; File: "5d3eaf9bca583330_0") Found string "_keyhttps://www.youtube.com/s/desktop/28b0985e/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js https://youtube.com/(^P|1,QS<" (Indicator: "youtube"; File: "639fa2a79cacd020_0") Found string "_keyhttps://www.youtube.com/s/desktop/28b0985e/jsbin/intersection-observer.min.vflset/intersection-observer.min.js https://youtube.com/" (Indicator: "youtube"; File: "175b72797b6c8a1f_0") Found string "_keyhttps://www.youtube.com/s/desktop/28b0985e/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js https://youtube.com/" (Indicator: "youtube"; File: "7d90a65a6160a465_0") Found string "_keyhttps://www.paypalobjects.com/web/res/ec5/d423d5ca948be117596b4b08bd315/js/lib/fn-sync-telemetry-min.js https://paypal.com/>\\" (Indicator: "GetDC"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")69:Tb54,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "WEXTRACT.EXE") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "WEXTRACT.EXE") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "WEXTRACT.EXE") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")6a:T869,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "WEXTRACT.EXE") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "WEXTRACT.EXE") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "WEXTRACT.EXE") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")6b:T57f,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "WEXTRACT.EXE") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "WEXTRACT.EXE") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "[InjectDependency] GetProcAddress failed." (Indicator: "GetProcAddress"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")6c:T10b3,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "WEXTRACT.EXE") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "WEXTRACT.EXE") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "WEXTRACT.EXE") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "WEXTRACT.EXE") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "WEXTRACT.EXE") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "WEXTRACT.EXE") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "WEXTRACT.EXE") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "WEXTRACT.EXE") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp")6d:T770,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "WEXTRACT.EXE") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "WEXTRACT.EXE") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "WEXTRACT.EXE") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00006424.00000001.71758.00BE2000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")6e:T714,Found string "password?" (Indicator: "password"; File: "screen_15.png") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "passwords.txt" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "catch save passwords$" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "SELECT action_url, origin_url, username_value, password_value FROM logins" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "catch passwords sql" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "mark_check_passwords" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "catch quantum passwords sql" (Indicator: "password"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp")6f:T500,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found string "\Device\HarddiskVolume2Roaming" (Indicator: "\Device\"; Source: "00000000-00006424.00000001.71758.03170000.00000004.mdmp")70:T852,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "WEXTRACT.EXE") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "WEXTRACT.EXE") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F4ED000.00000002.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")71:T636,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "WEXTRACT.EXE") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")72:T98a,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableBehaviorMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableBlockAtFirstSeen $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableIOAVProtection $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableIntrusionPreventionSystem $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -SubmitSamplesConsent 2" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -MAPSReporting 0" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp")73:T8f2,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "WEXTRACT.EXE") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "WEXTRACT.EXE") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "WEXTRACT.EXE") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "WEXTRACT.EXE") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "WEXTRACT.EXE") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00008164.00000000.66965.012F1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00008164.00000000.66965.012F1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")74:T550,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "WEXTRACT.EXE") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")75:T1096,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "WEXTRACT.EXE") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "WEXTRACT.EXE") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "WEXTRACT.EXE") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "WEXTRACT.EXE") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "WEXTRACT.EXE") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000416.00000000.67023.03050000.00000004.mdmp, 00000000-00000416.00000001.68942.03050000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00006424.00000000.69837.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.03170000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")76:T428,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "WEXTRACT.EXE") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "WEXTRACT.EXE") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000416.00000000.67023.00F0C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp, 00000000-00006424.00000001.71758.6F503000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008164.00000000.66965.012FA000.00000002.mdmp")77:Tbaa,"1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "2310D0CA0137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "825EA3CF0137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "60F9A7C80137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "2B0872C70137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "9AC5D2D80137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "7FFE2ADC0137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "3BFC65D30137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "0703BDD70137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "1B5FEBDE0137DA0100000000000000000000000002000000"), "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "a�X�")78:Tbb0,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: WEXTRACT.EXE] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: WEXTRACT.EXE] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: WEXTRACT.EXE] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: WEXTRACT.EXE] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: WEXTRACT.EXE] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1PZ89wW4.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 1PZ89wW4.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 1PZ89wW4.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 1PZ89wW4.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 1PZ89wW4.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 1PZ89wW4.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1PZ89wW4.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1PZ89wW4.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 1PZ89wW4.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 1PZ89wW4.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1PZ89wW4.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1PZ89wW4.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 1PZ89wW4.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1PZ89wW4.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 1PZ89wW4.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1PZ89wW4.exe]79:T9ae,"WEXTRACT.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\1PZ89WW4.EXE"; Value: "") "WEXTRACT.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\4ZM853KO.EXE"; Value: "") "1PZ89wW4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: ""), "4ZM853ko.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")7a:T98a,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableBehaviorMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableBlockAtFirstSeen $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableIOAVProtection $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableIntrusionPreventionSystem $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -SubmitSamplesConsent 2" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -MAPSReporting 0" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp")7b:Te61,Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00006424] Dropped file: "data_3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00007076] Dropped file: "load_statistics.db-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00006424] Dropped file: "data_2" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00007076] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00007076] Dropped file: "f_0004da" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004da]- [targetUID: 00000000-00007076] Dropped file: "f_0004f0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f0]- [targetUID: 00000000-00007076] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00003856] Dropped file: "load_statistics.db" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db]- [targetUID: 00000000-00006424] Dropped file: "f_0004cb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cb]- [targetUID: 00000000-00007076] Dropped file: "000009.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00007632] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00007076] Dropped file: "f_0004f3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f3]- [targetUID: 00000000-00007076] Dropped file: "f_0004f2" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f2]- [targetUID: 00000000-00007076] Dropped file: "f_0004cd" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cd]- [targetUID: 00000000-00007076] Dropped file: "f_0004de" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004de]- [targetUID: 00000000-00007076] Dropped file: "f_0004c7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007076] Dropped file: "History" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00000416] Dropped file: "data_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00007076] Dropped file: "f_0004ef" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ef]- [targetUID: 00000000-00007076] Dropped file: "Visited Links" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00006424] Dropped file: "f_0004c6" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00007076] Dropped file: "f_0004c3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00007076] Dropped file: "f_0004ca" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ca]- [targetUID: 00000000-00007076] Dropped file: "Tabs_13347961981519974" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13347961981519974]- [targetUID: 00000000-00007632]7c:T4b9,"1PZ89wW4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\1PZ89wW4.exe]- [targetUID: 00000000-00008164] "4ZM853ko.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP000.TMP\4ZM853ko.exe]- [targetUID: 00000000-00008164] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\tempAVSiCR0qs2iDTrY\sqlite3.dll]- [targetUID: 00000000-00006424] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00006424] "OfficeTrackerNMP131.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00006424] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00006424]7d:T4b7,"WEXTRACT.EXE" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "WEXTRACT.EXE" wrote 839 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "4ZM853ko.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\sqlite3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7e:T8e9,"4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\VkKdGaR80Ut2formhistory.sqlite" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\hz1eMNOGAR76Login Data" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\xGuAyDSyW6Edplaces.sqlite-shm" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\xGuAyDSyW6Edplaces.sqlite-wal" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\xGuAyDSyW6Edplaces.sqlite" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\QmSgZSSgpbKNcookies.sqlite-shm" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\QmSgZSSgpbKNcookies.sqlite-wal" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\QmSgZSSgpbKNcookies.sqlite" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\eycuZ3En43qcplaces.sqlite-shm" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\eycuZ3En43qcplaces.sqlite-wal" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\eycuZ3En43qcplaces.sqlite" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\k8UyqcMwHIGAWeb Data" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\51qcDnIEmt9uHistory" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\KoZiiAToNt1zWeb Data" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\mKJFa4UOJFcKWeb Data" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\KW4TafHVowS9Cookies" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\n4y3o5MrYEYdHistory" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tempAVSiCR0qs2iDTrY\2r793jXbpERi000004.log" for deletion "4ZM853ko.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\q4BDq7il3R3T9P6iEZQhFrC41yqmdtSb.zip" for deletion7f:T9cc,"4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "4ZM853ko.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")80:T1f08,"WEXTRACT.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F0\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "SLOWCONTEXTMENUENTRIES"; Value: "6024B221EA3A6910A2DC08002B30309D480100000114020000000000C0000000000000469D0000006078A409B011A54DAFA526D86198A7806E000000FB9A790967ADD111ABCD00C04FC309367D0000000000000000000000000000000000000000000000") "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "2310D0CA0137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "SLOWCONTEXTMENUENTRIES"; Value: "6024B221EA3A6910A2DC08002B30309DA00200000114020000000000C0000000000000469D0000006078A409B011A54DAFA526D86198A7806E000000FB9A790967ADD111ABCD00C04FC309367D0000000000000000000000000000000000000000000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "825EA3CF0137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "60F9A7C80137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "0000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "2B0872C70137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "9AC5D2D80137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "7FFE2ADC0137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "3BFC65D30137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC4C75"; Value: "4E000000000000000400000001010100B1CE9800090074007E0007809E1124006000600063EE1D0000009A11240060000E3F1A0060000000530000006F6E65636F72657561705C7368656C6C5C77696E646F77732E73746F726167655C657865636173736F632E6370700031505A38397757342E6578650077696E646F77732E73746F726167652E646C6C00"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "DA140000000000000400040001002700020000000D78790016DDA4001E8D520021777A00259960002C3D810036AC52003E33830042264A004AAA8100560A8500726E4A007477AD0075A37E007814B00078EF6400799C39008106950087DE83008E78A200938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CC495600CF74AA00D3826100D3E88D00E1C97700E21B5600E7997F00F1FC6000F7125E00F7D36F00F7ED6A0005000600000019C398001C4452007140A30091508A00DC38AB00"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "0703BDD70137DA0100000000000000000000000002000000"), "1PZ89wW4.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "1B5FEBDE0137DA0100000000000000000000000002000000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\4ZM853KO_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F0\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe"), "4ZM853ko.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "a�X�")81:T739,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA RegCreateKeyExW CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW GetFileAttributesW FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW GetSystemDirectoryW ExitThread GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW GetFileSize OpenProcess ReadProcessMemory CreateDirectoryW DeleteFileW GetTempFileNameW GetComputerNameW FindNextFileW FindFirstFileW FindFirstFileExW CreateFileW VirtualAllocEx Process32NextW GetCommandLineW GetCommandLineA CopyFileExW Process32FirstW GetTempPathW CreateProcessW VirtualAlloc ShellExecuteW ShellExecuteExW GetCursorPos GetClipboardData SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto CryptEncrypt MapViewOfFile CreateFileMappingW CreateFileMappingA OutputDebugStringA GetFileAttributesExW82:T460,"abs.twimg.com" with TTL 300 "accounts.google.com" with TTL 260 "ad.doubleclick.net" with TTL 300 "adservice.google.com" with TTL 16 "api.twitter.com" with TTL 170 "api.x.com" with TTL 300 "c.paypal.com" with TTL 140 "community.cloudflare.steamstatic.com" with TTL 300 "dpm.demdex.net" with TTL 133 "facebook.com" with TTL 300 "fbcdn.net" with TTL 300 "fbsbx.com" with TTL 300 "fonts.googleapis.com" with TTL 244 "fonts.gstatic.com" with TTL 228 "googleads.g.doubleclick.net" with TTL 300 "i.ytimg.com" with TTL 53 "lnkd.demdex.net" with TTL 122 "play.google.com" with TTL 45 "static-assets-prod.unrealengine.com" with TTL 300 "static.licdn.com" with TTL 285 "steamcommunity.com" with TTL 20 "store.cloudflare.steamstatic.com" with TTL 300 "store.steampowered.com" with TTL 20 "stun.l.google.com" with TTL 300 "t.co" with TTL 300 "t.paypal.com" with TTL 72 "tracking.epicgames.com" with TTL 300 "video.twimg.com" with TTL 102 "www.google.com" with TTL 20 "www.googleadservices.com" with TTL 218 "www.gstatic.com" with TTL 95 "www.recaptcha.net" with TTL 300 "www.youtube.com" with TTL 17883:T490,"ipinfo.io" (Indicator: "ipinfo.io"; File: "00000000-00006424.00000001.71758.03170000.00000004.mdmp, 00000000-00006424.00000001.71758.051D0000.00000004.mdmp") "ttps://ipinfo.io/widget/demo/67.218.111.202" (Indicator: "ipinfo.io"; File: "00000000-00006424.00000001.71758.03170000.00000004.mdmp") "ttps://ipinfo.io/" (Indicator: "ipinfo.io"; File: "00000000-00006424.00000001.71758.03170000.00000004.mdmp") "https://ipinfo.io/widget/demo/" (Indicator: "ipinfo.io"; File: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") "https://ipinfo.io/widget/demo/67.218.111.202" (Indicator: "ipinfo.io"; File: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") "https://ipinfo.io/" (Indicator: "ipinfo.io"; File: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") "https://ipinfo.io" (Indicator: "ipinfo.io"; File: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") "https://maxmind.com/geoip/v2.1/city/me" (Indicator: "maxmind.com"; File: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp") "https://www.maxmind.com/en/locate-my-ip-address" (Indicator: "maxmind.com"; File: "00000000-00006424.00000001.71758.051D0000.00000004.mdmp")84:T420,"4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "4ZM853ko.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL")85:T2347,"4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Diagnostic Data" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Diagnostic Data-wal" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\First Run" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Version" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\lockfile" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\persisted_first_party_sets.json" "4ZM853ko.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Variations" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "4ZM853ko.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT"86:T29e5,4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 4ZM853ko.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask87:T574,Spawned process "WEXTRACT.EXE" (UID: 00000000-00008164) Spawned process "1PZ89wW4.exe" (UID: 00000000-00000416) Spawned process "4ZM853ko.exe" (UID: 00000000-00006424) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" (UID: 00000000-00002644) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" (UID: 00000000-00002200) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" (UID: 00000000-00004664) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" (UID: 00000000-00005436) Spawned process "WerFault.exe" with commandline "-pss -s 456 -p 6424 -ip 6424" (UID: 00000000-00006400) Spawned process "WerFault.exe" with commandline "-u -p 6424 -s 3416" (UID: 00000000-00002448) Spawned process "WerFault.exe" with commandline "-u -p 6424 -s 3416" (UID: 00000000-00006432)88:T41d,Found string - return /^\S+@\S+\.\S+$/;; Source: "signin-split_1_.js") Found string - var EMAIL_PTN = /^\S+@\S+\.\S+$/;; Source: "signin-split_1_.js") Found string - !\uff01]/[!\uff01];["\uff02]/["\uff02];[\#\uff03]/[\#\uff03];[\$\uff04]/[\$\uff04];[%\uff05]/[%\uff05];[&\uff06]/[&\uff06];[\u0027\uff07]/[\u0027\uff07];[$\uff08]/[\(\uff08];[$\uff09]/[\)\uff09];[\*\uff0a]/[\*\uff0a];[\+\uff0b]/[\+\uff0b];[ \uff0c]/[ \uff0c];[-\uff0d]/[-\uff0d];[\.\uff0e]/[\.\uff0e];[\u002f\uff0f]/[\u002f\uff0f];[:\uff1a]/[:\uff1a];[\u003b\uff1b]/[\u003b\uff1b];[<\uff1c]/[<\uff1c];[=\uff1d]/[=\uff1d];[>\uff1e]/[>\uff1e];[\?\uff1f]/[\?\uff1f];[@\uff20]/[@\uff20];[\[\uff3b]/[\[\uff3b];[\\\\uff3c]/[\\\\uff3c];[]\uff3d]/[]\uff3d];[\^\uff3e]/[\^\uff3e];[_\uff3f]/[_\uff3f];[`\uff40]/[`\uff40];[\{\uff5b]/[\{\uff5b];[\|\uff5c]/[\|\uff5c];[}\uff5d]/[}\uff5d];[~\uff5e]/[~\uff5e];[\u3002\uff61]/[\u3002\uff61];[\u300C\uff62]/[\u300C\uff62];[\u300D\uff63]/[\u300D\uff63];[\u3001\uff64]/[\u3001\uff64]M; Source: "00000000-00002436.00000001.67783.02C80000.00000002.mdmp")89:T661e,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s.ss2.us" Contains base64 string in header "User" in header "GET /r.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s.ss2.us" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bmc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2BXrrguICEAxnRZO2jQMmUC0dFSq96X0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/gts1c3/zdATt0Ex" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/zdATt0Ex_Fk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"8a:T3b5a,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2348 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 07:12:09 GMT Last-Modified: Mon 25 Dec 2023 06:33:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 152578 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 25 Dec 2023 07:12:14 GMT Etag: "614b5ba7-243" expires: Wed 27 Dec 2023 07:12:14 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Mon 25 Dec 2023 03:46:32 GMT X-Sucuri-ID: 11036 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Mon 25 Dec 2023 02:32:05 GMT Expires: Tue 26 Dec 2023 02:32:05 GMT ETag: "24b768558e9d3777e20a334db4a04949163653cb" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT X-Cache: Hit from cloudfront Via: 1.1 924f274426b01d503d2c81865df2443c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: gfMyECYlMIXczcAZ8FMAOdnV_Ee512ZvQkQt21DB9JJEdHRA4bu2Zw== Age: 12343 with response body ==>....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 713 Connection: keep-alive Last-Modified: Tue 19 Dec 2023 14:32:06 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: EiLyfWbiUENPnDRPID7nN8VSQR7.ATIi Accept-Ranges: bytes Server: AmazonS3 Date: Mon 25 Dec 2023 07:08:15 GMT ETag: "17529b3e2cbd518730e68190e9f121a9" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c3d007e42510cc2bd48d2a205774e488.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-C1 X-Amz-Cf-Id: 1_o_4KScM-JnyDJ2ug2AFiESidPN9riSeQ9SMMa99fLGPpeyChH4qw== Age: 241 with response body ==>....... "GET /r.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: s.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 486 Connection: keep-alive Last-Modified: Wed 08 Nov 2023 23:31:41 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: vh9_.F5f0qUMnY3L0UoDMODo4pSLvpbc Accept-Ranges: bytes Server: AmazonS3 Date: Mon 25 Dec 2023 06:28:26 GMT ETag: "a8fb889989c036b9c5f50300861d295c" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 58f9a50682bb94842197f3e957919c60.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: aim99nFpzny_L9PT9uiIXtk4HsRqKvCWjkUuIHhRTTkQw-SoUZj5AQ== Age: 2630 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1426 Connection: keep-alive Date: Mon 25 Dec 2023 06:27:51 GMT Last-Modified: Mon 25 Dec 2023 06:27:51 GMT ETag: 8957a7bfdb812a14c25216c4de464089f5c23ca9 Expires: Mon 01 Jan 2024 06:27:51 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 152580 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 25 Dec 2023 07:12:16 GMT Etag: "614b5ba7-243" expires: Wed 27 Dec 2023 07:12:16 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /r2m02.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 506914 Connection: keep-alive Accept-Ranges: bytes Last-Modified: Mon 25 Dec 2023 02:15:15 GMT Server: nginx Cache-Control: max-age=7200 Cache-Control: public Date: Mon 25 Dec 2023 06:47:37 GMT Expires: Mon 25 Dec 2023 08:47:37 GMT ETag: "6588e5b3-7bc22" X-Cache: Hit from cloudfront Via: 1.1 9c3ba7b1ce4e43dbcf29ae887d546a76.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P6 X-Amz-Cf-Id: cSkWDri4L5SJxqQQWPqS-dI2__wOshxCstnPRUs_RwAp1tj7OFgzpg== Age: 1480 with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2357 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 07:12:18 GMT Last-Modified: Mon 25 Dec 2023 06:33:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 483 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 07:12:22 GMT Last-Modified: Mon 25 Dec 2023 07:04:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 651 Connection: keep-alive Last-Modified: Tue 19 Dec 2023 14:31:56 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: .ZkV25BdNGPSQbTBX9HUJUD8KvZN8SLs Accept-Ranges: bytes Server: AmazonS3 Date: Mon 25 Dec 2023 05:15:04 GMT ETag: "9058c82ab542b2701eb78e0a4e482593" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 74aa91fe819001bcedd882694f52b436.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: iyX-pgPS2LmTyvnCBycIWUesNa3xrNia1tu2ELPElmF74MmXZFZeLA== Age: 7038 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1548 Connection: keep-alive Date: Mon 25 Dec 2023 06:54:51 GMT Last-Modified: Mon 25 Dec 2023 06:54:51 GMT ETag: 8bc7fb5a0bded360d3b70f223432307ce13e07fe Expires: Mon 01 Jan 2024 06:54:51 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2362 Cache-Control: max-age=7200 Date: Mon 25 Dec 2023 07:12:23 GMT Last-Modified: Mon 25 Dec 2023 06:33:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2364 Cache-Control: max-age=7200 Date: Mon 25 Dec 2023 07:12:25 GMT Last-Modified: Mon 25 Dec 2023 06:33:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2365 Cache-Control: max-age=7200 Date: Mon 25 Dec 2023 07:12:26 GMT Last-Modified: Mon 25 Dec 2023 06:33:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 152590 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 25 Dec 2023 07:12:26 GMT Etag: "614b5ba7-243" expires: Wed 27 Dec 2023 07:12:26 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Mon 25 Dec 2023 06:13:38 GMT Server: ECAcc (sac/2532) X-Cache: Hit from cloudfront Via: 1.1 7213dea1fc38301ac719160ac4d5ab22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P3 X-Amz-Cf-Id: BX7TAzNspuiIuaEDwqY7NEWeVu7r7WpgICOkZW3bBs9VqByuV_cz0g== Age: 3527 with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 488 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 07:12:27 GMT Last-Modified: Mon 25 Dec 2023 07:04:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2369 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 25 Dec 2023 07:12:30 GMT Last-Modified: Mon 25 Dec 2023 06:33:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 152595 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 25 Dec 2023 07:12:31 GMT Etag: "614b5ba7-243" expires: Wed 27 Dec 2023 07:12:31 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 152596 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 25 Dec 2023 07:12:32 GMT Etag: "614b5ba7-243" expires: Wed 27 Dec 2023 07:12:32 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 152597 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 25 Dec 2023 07:12:33 GMT Etag: "614b5ba7-243" expires: Wed 27 Dec 2023 07:12:33 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 25 Dec 2023 06:42:05 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1831 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32.......8b:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")8c:T54f,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /DigiCertGlobalRootG3.crt" Found http requests in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D" Found http requests in header "GET /rootg2.crl" Found http requests in header "GET /r.crl" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D" Found http requests in header "GET /r2m02.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET /rootca1.crl" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"8d:T2370,Found requests in header "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/static/js/main.bb112302.chunk.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/static/js/3.0db8cc9a.chunk.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/static/js/main.bb112302.chunk.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comIf-Modified-Since: Thu, 14 Dec 2023 20:58:07 GMTIf-None-Match: W/"7ea59d1db78934683cfb63075946210f"DNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/static/js/3.0db8cc9a.chunk.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comIf-Modified-Since: Thu, 14 Dec 2023 20:58:06 GMTIf-None-Match: W/"ade4283d8eeb5e99e0a9928e04d88211"DNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/epic-favicon-96x96.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/static/js/polyfills.b542ecef.chunk.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/static/js/4.05541e58.chunk.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/static/css/4.5a6e1f27.chunk.css HTTP/1.1Accept: text/css, */*Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/signin-split.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webcaptcha/ngrlCaptcha.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/shared/icon-PN-check.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/ec5/d423d5ca948be117596b4b08bd315/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/shared/glyph_alert_critical_big-2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Regular.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.epicgames.comIf-Modified-Since: Thu, 14 Dec 2023 20:54:45 GMTIf-None-Match: W/"657b6b95-205a"DNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /openid/loginform HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: steamcommunity.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: steamcommunity.comDNT: 1Connection: Keep-AliveCookie: sessionid=e67de023e64dfc35950a49e1; steamCountry=US%7Cd5203a3b374fc04fbcd23a13412805b3"; in File: "SSL") Found requests in header "GET /tracking.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: tracking.epicgames.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL")8e:T4e7,Found string "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /account-portal/static/epic-favicon-96x96.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL")8f:T2e3f,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLw" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDk" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "IWZzHshBOCggCEwdzEkpLy9ROx7U76vGU" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 25 Dec 2023 06:33:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmb" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPe" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAQhMPexOPTAYsl3zILaFNw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvz" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"90:T47e,"header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "epic-favicon-96x96_1_.png" has type "PNG image data 96 x 96 8-bit/color RGBA non-interlaced" and extension "png" "sprite_form_2x_1_.png" has type "PNG image data 48 x 1350 8-bit colormap non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_1_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "glyph_alert_critical_big-2x_1_.png" has type "PNG image data 224 x 200 8-bit colormap non-interlaced" and extension "png" "icon-PN-check_1_.png" has type "PNG image data 121 x 133 8-bit colormap non-interlaced" and extension "png" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png"91:T4001,"initAft()