26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 85:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 5658f2d0a678… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5658f2d0a678…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/27 AV engines flagged this file. 25 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5658f2d0a6782fa0c9ec353a37d0252e308e373d28c8570f9765fc79d3a6bb2f","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","5658f2d0a6782fa0c9ec353a37d0252e308e373d28c8570f9765fc79d3a6bb2f"],"about":{"@type":"SoftwareApplication","name":"37303cf95e57208d991e49c540cba294.exe","applicationCategory":["peexe","executable"],"identifier":"5658f2d0a6782fa0c9ec353a37d0252e308e373d28c8570f9765fc79d3a6bb2f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":25,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5e0,"37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325496" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325504" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325532" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325744" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325560" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325716" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325728" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "1440540" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325612" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325708" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "1440536" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325576" - (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "FindResourceA" with parameter "12325584" - (UID: 00000000-00007908)28:Tb88,"37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372096'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12371952'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372112'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372000'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12371968'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372016'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372064'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12371936'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372048'}" (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372080'}" (UID: 00000000-00007908) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721344'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721200'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721360'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721248'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721216'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721264'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721312'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721184'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721296'}" (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3721328'}" (UID: 00000000-00006380) "hf2WE47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15911040'}" (UID: 00000000-00001088) "hf2WE47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15910896'}" (UID: 00000000-00001088) "hf2WE47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15911056'}" (UID: 00000000-00001088)29:Tbcc,"37303cf95e57208d991e49c540cba294.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007908) "Ct3zm66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006380) "Ct3zm66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006380) "hf2WE47.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00001088) "hf2WE47.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00001088) "hf2WE47.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00001088) "wM6yJ36.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00003948) "wM6yJ36.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00003948) "wM6yJ36.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00003948) "wM6yJ36.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00003948) "wM6yJ36.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00003948) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Autofill (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\My Music (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\My Pictures (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\My Videos (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\OneNote Notebooks\My Notebook (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\OneNote Notebooks\OneNote 2010 Guide (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\OneNote Notebooks (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\Outlook Files (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\.mitmproxy (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\3D Objects (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe\Acrobat\11.0\Cache (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe\Acrobat\11.0 (UID: 00000000-00000408) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00000408)2a:T46f,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")2b:T9a2,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")2c:T446,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)2d:T22bc,"37303cf95e57208d991e49c540cba294.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007908) "Ct3zm66.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006380) "Ct3zm66.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006380) "hf2WE47.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001088) "hf2WE47.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001088) "wM6yJ36.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003948) "wM6yJ36.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003948) "1Lz43pU7.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007112) "1Lz43pU7.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007112) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000408) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000297400009600000000002d6e29745ed85b6f11000000181aa472f0d2cf00008a96000400000008000000a40296008000000030d2cf0000000000b4d2cf0070c82a74ca7bbb1bfeffffff11000000503ca5720e00000084d2cf00856a2b741c233074c4d2cf00f85f2b7408000000bb692a74b2692a74f6d85b6f11000000181aa4720e000000503ca57298d2cf0011000000503ca5720e000000c8d2cf00856a2b741c23307410d3cf00b90ea5723614a572ae0ea572b678f27c11000000181aa4720e000000503ca572d8049600a0049600b678f27cd8d2cf000a5ea472c4d3cf004014a572fe099b0efeffffffae0ea572c80ea572503ca57240d3cf00 (UID: 00000000-00000408) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b8cfcf0038cf5d77fc34090324d0cf0001000000b0340903fc340903b0340903040000000400000000e0b0740010000024d0cf0001000000b0340903cd975d779c975d7707cb48f3b50fa774b034090300005d7700000000d412e1730000000080eead740100000000000000f8e2b074000000000400000080a9e3734840af74f8e2b07428d0cf0080e8c574c8d2090380e8c57424d0cf000000000080e8c5749c60c3fdfeffffff0000000000000000000000000500000010700c0302000000020000000a00000000700c0310700c0300000000f178ba44a8d2cf00ddf3a4749cd0cf000000000000700c030a000000f8f3a47400700c03 (UID: 00000000-00000408) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000cf00206cdc720100000054c8cf003f31db72a560ba44a8c9cf000000000030003200f8160b03010000001cc9cf00321eda720000d3d500000000003ca4747a1fda720000000000000000000000006400000001000000000000008000108078c9cf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050f55c77000000000000000003000000000000000000000000000000ffffffff00000000000000000000000038430b034c430b03 (UID: 00000000-00000408)2e:T8e5,"37303cf95e57208d991e49c540cba294.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f91500cc7ddb72409a4a0000000000d0f915002447db72409a4a0028fa1500d527db72409a4a0001000000c1d0dfb700000000fccd5f3a0000000003000000dcfa15000a000000740f000020fb150058fa15005b00000003000000e0f91500e8f91500f0fc15005059db72693a17c5feffffff30fb150047f2d972fccd5f3a (UID: 00000000-00007908) "Ct3zm66.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f6f700cc7ddb7248ba52030000000098f6f7002447db7248ba5203f0f6f700d527db7248ba52030100000044dc68120000000056a47c2f0000000003000000a4f7f7000a00000084180000e8f7f70020f7f7005b00000003000000a8f6f700b0f6f700b8f9f7005059db72343a4260fefffffff8f7f70047f2d97256a47c2f (UID: 00000000-00006380) "hf2WE47.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007ddb7288ae960000000000e8f763002447db7288ae960040f86300d527db7288ae96000100000053b4fec700000000aa742d370000000003000000f4f863000a000000f417000038f9630070f863005b00000003000000f8f7630000f863000cfb63005059db72935c40b5feffffff4cf9630047f2d972aa742d3700000000 (UID: 00000000-00001088) "wM6yJ36.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f78f00cc7ddb72c0b9c9000000000028f78f002447db72c0b9c90080f78f00d527db72c0b9c90001000000a756d6b700000000d9aa1835000000000300000034f88f000a0000002804000078f88f00b0f78f005b0000000300000038f78f0040f78f0048fa8f005059db72a7b184c5feffffff88f88f0047f2d972d9aa1835 (UID: 00000000-00003948) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000165d771802000020020000a40309037cdbb205100200000000090300000000200200000000000000000000440000000300000000000903180200000000000059165d77b4dbb205ee135d7710dcb205ee135d770000000000000000180200001802000009000000ccdbb205763e510000000903000000001802000010020000 (UID: 00000000-00000408) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00001052)2f:T76e,"37303cf95e57208d991e49c540cba294.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "37303cf95e57208d991e49c540cba294.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Ct3zm66.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Ct3zm66.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "hf2WE47.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "hf2WE47.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wM6yJ36.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wM6yJ36.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Lz43pU7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1Lz43pU7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2tJ8730.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2tJ8730.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3CW36NV.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")30:T46c,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")31:T9a2,"AppLaunch.exe" queries volume information of "C:\" at 00000000-00000408-00000C15-55531074 "AppLaunch.exe" queries volume information of "C:\" at 00000000-00000408-00000C15-60169221 "AppLaunch.exe" queries volume information of "C:\" at 00000000-00000408-00000C15-66321242 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00001052-00000C15-57623498 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00001052-00000C15-57952623 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00001052-00000C15-58347133 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00001052-00000C15-60040982 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00001052-00000C15-61740018 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll" at 00000000-00001052-00000C15-62081693 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00000000-00001052-00000C15-62172390 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00001052-00000C15-62839203 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001052-00000C15-63289740 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001052-00000C15-63306972 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001052-00000C15-6330718432:T940,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\APPLAUNCH.EXE") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME")33:T8ae,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")34:T501,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")35:Tc76,"AppLaunch.exe" called "CopyFileA" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\signons.sqlite to new location %TEMP%\posterBox7V4P1WC8j2P1l\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\formhistory.sqlite to new location %TEMP%\posterBox7V4P1WC8j2P1l\8ghN89CsjOW1formhistory.sqlite (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %TEMP%\posterBox7V4P1WC8j2P1l\Ei8DrAmaYu9KLogin Data (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\places.sqlite to new location %TEMP%\posterBox7V4P1WC8j2P1l\D87fZN3R3jFeplaces.sqlite (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\\Login Data For Account to new location %TEMP%\posterBox7V4P1WC8j2P1l\8ghN89CsjOW1Login Data For Account (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\cookies.sqlite to new location %TEMP%\posterBox7V4P1WC8j2P1l\02zdBXl47cvzcookies.sqlite (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\places.sqlite to new location %TEMP%\posterBox7V4P1WC8j2P1l\3b6N2Xdh3CYwplaces.sqlite (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\posterBox7V4P1WC8j2P1l\D87fZN3R3jFeWeb Data (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\posterBox7V4P1WC8j2P1l\02zdBXl47cvzHistory (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\posterBox7V4P1WC8j2P1l\3b6N2Xdh3CYwWeb Data (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\\Cookies to new location %TEMP%\posterBox7V4P1WC8j2P1l\5lop_S5WM5ERCookies (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies to new location %TEMP%\posterBox7V4P1WC8j2P1l\oOPEmFmu_xsJCookies (UID: 00000000-00000408) "AppLaunch.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\posterBox7V4P1WC8j2P1l\IWPfiAXUTJTSHistory (UID: 00000000-00000408)36:Tc45,"37303cf95e57208d991e49c540cba294.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007908) "Ct3zm66.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006380) "hf2WE47.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00001088) "wM6yJ36.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00003948) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Autofill (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Downloads (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\My Music (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\My Pictures (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\My Videos (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\OneNote Notebooks (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\OneNote Notebooks\My Notebook (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\OneNote Notebooks\OneNote 2010 Guide (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\Outlook Files (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\.mitmproxy (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\3D Objects (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe\Acrobat\11.0 (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe\Acrobat\11.0\Cache (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe\Color (UID: 00000000-00000408) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Adobe\Color\Profiles (UID: 00000000-00000408)37:T39f0,"37303cf95e57208d991e49c540cba294.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007908) "Ct3zm66.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006380) "Ct3zm66.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006380) "hf2WE47.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001088) "hf2WE47.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001088) "hf2WE47.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001088) "hf2WE47.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001088) "hf2WE47.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001088) "hf2WE47.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00001088) "hf2WE47.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001088) "wM6yJ36.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003948) "wM6yJ36.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003948) "wM6yJ36.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003948) "wM6yJ36.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003948) "wM6yJ36.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003948) "wM6yJ36.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003948) "wM6yJ36.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003948) "1Lz43pU7.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007112) "1Lz43pU7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007112) "1Lz43pU7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007112) "1Lz43pU7.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007112) "1Lz43pU7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007112) "1Lz43pU7.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007112) "1Lz43pU7.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007112) "1Lz43pU7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007112) "1Lz43pU7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007112) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00000408) "2tJ8730.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007176) "2tJ8730.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007176) "2tJ8730.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007176) "2tJ8730.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007176) "2tJ8730.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007176) "2tJ8730.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007176) "2tJ8730.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007176) "2tJ8730.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007176) "2tJ8730.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007176) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00001052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001052) "3CW36NV.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001040) "3CW36NV.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001040) "3CW36NV.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001040) "3CW36NV.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001040) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004024) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004024) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004024) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004024) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001508) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001508) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001508) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001508)38:T11285,"37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007908) "37303cf95e57208d991e49c540cba294.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007908) "Ct3zm66.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00006380) "Ct3zm66.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006380) "hf2WE47.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00001088) "hf2WE47.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001088) "wM6yJ36.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003948) "wM6yJ36.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003948) "1Lz43pU7.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00007112) "1Lz43pU7.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007112) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultFree (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultCloseVault (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultGetItem (UID: 00000000-00000408) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000408) "2tJ8730.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00007176) "2tJ8730.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007176) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001052) "3CW36NV.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001040) "3CW36NV.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001040) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004024) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001508) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001508)39:T11b3,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000001.70201.03440000.00000004.mdmp, 00000000-00001040.00000001.70201.034B0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.034B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001040.00000001.70201.034B0000.00000004.mdmp, 00000000-00001040.00000002.72122.034B0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.007F0000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "vateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")3a:T9b8,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")3b:T578,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")3c:Ta55c,Found reference to API (Indicator: "CheckTokenMembership"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "DecryptFileA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "FreeSid"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "EqualSid"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "RegCloseKey"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "FindNextFileA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "FindClose"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LocalAlloc"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "lstrcmpA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CompareStringA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetLastError"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "DeleteFileA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GlobalFree"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CloseHandle"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetProcAddress"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GlobalLock"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LocalFree"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "FreeLibrary"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "ReadFile"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SizeofResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "WriteFile"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetFileTime"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetFilePointer"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "FindResourceA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CreateMutexA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "FreeResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetVersion"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetTempPathA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CreateFileA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetEvent"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "TerminateThread"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetVersionExA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LockResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CreateThread"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "ResetEvent"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LoadResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "ExitProcess"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CreateProcessA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "FormatMessageA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CreateEventA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CharUpperA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "MessageBeep"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CharPrevA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "LoadStringA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CharNextA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "EnableWindow"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "ReleaseDC"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "PeekMessageA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SendMessageA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "MessageBoxA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "ShowWindow"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetWindowPos"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetDC"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetWindowRect"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "Sleep"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "TerminateProcess"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetTickCount"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "MulDiv"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API (Indicator: "MessageBoxW"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "IsDebuggerPresent"; File: "MaxLoonaFest131.exe.1646122814") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001088.00000001.69858.00F21000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001088.00000001.69858.00F21000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00001088.00000001.69858.00F21000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")3d:T77e,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")3e:T7f2,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp")3f:T593,"AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]40:T595,"37303cf95e57208d991e49c540cba294.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1Lz43pU7.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Ct3zm66.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "hf2WE47.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "wM6yJ36.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2tJ8730.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5Hv1pF6.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "FANBooster131.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT41:T34f6,"37303cf95e57208d991e49c540cba294.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "37303cf95e57208d991e49c540cba294.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "37303cf95e57208d991e49c540cba294.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "37303cf95e57208d991e49c540cba294.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "37303cf95e57208d991e49c540cba294.exe" loaded module "KERNEL32.DLL" at base 743b0000 "37303cf95e57208d991e49c540cba294.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76610000 "37303cf95e57208d991e49c540cba294.exe" loaded module "FECLIENT.DLL" at base 72cb0000 "37303cf95e57208d991e49c540cba294.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72c80000 "37303cf95e57208d991e49c540cba294.exe" loaded module "NTDLL.DLL" at base 77590000 "37303cf95e57208d991e49c540cba294.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e10000 "Ct3zm66.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "Ct3zm66.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "Ct3zm66.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "Ct3zm66.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "Ct3zm66.exe" loaded module "KERNEL32.DLL" at base 743b0000 "Ct3zm66.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76610000 "Ct3zm66.exe" loaded module "FECLIENT.DLL" at base 72cb0000 "Ct3zm66.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72c80000 "Ct3zm66.exe" loaded module "NTDLL.DLL" at base 77590000 "Ct3zm66.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e10000 "hf2WE47.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "hf2WE47.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "hf2WE47.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "hf2WE47.exe" loaded module "KERNEL32" at base 743b0000 "hf2WE47.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "hf2WE47.exe" loaded module "KERNEL32.DLL" at base 743b0000 "hf2WE47.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76610000 "hf2WE47.exe" loaded module "FECLIENT.DLL" at base 72cb0000 "hf2WE47.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72c80000 "hf2WE47.exe" loaded module "NTDLL.DLL" at base 77590000 "hf2WE47.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e10000 "wM6yJ36.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "wM6yJ36.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "wM6yJ36.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "wM6yJ36.exe" loaded module "KERNEL32" at base 743b0000 "wM6yJ36.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "wM6yJ36.exe" loaded module "KERNEL32.DLL" at base 743b0000 "wM6yJ36.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76610000 "wM6yJ36.exe" loaded module "FECLIENT.DLL" at base 72cb0000 "wM6yJ36.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72c80000 "wM6yJ36.exe" loaded module "NTDLL.DLL" at base 77590000 "wM6yJ36.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e10000 "1Lz43pU7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "1Lz43pU7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "1Lz43pU7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "1Lz43pU7.exe" loaded module "KERNEL32" at base 743b0000 "1Lz43pU7.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "1Lz43pU7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74960000 "1Lz43pU7.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74960000 "1Lz43pU7.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74960000 "1Lz43pU7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74960000 "1Lz43pU7.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 765e0000 "1Lz43pU7.exe" loaded module "NTDLL.DLL" at base 77590000 "1Lz43pU7.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "AppLaunch.exe" loaded module "KERNEL32" at base 743b0000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74960000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74960000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74960000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74960000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73940000 "AppLaunch.exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 72ba0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 77220000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 743b0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74b40000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77590000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73410000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74b40000 "AppLaunch.exe" loaded module "CSCAPI.DLL" at base 731d0000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 73ec0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e10000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 6f0a0000 "AppLaunch.exe" loaded module "WININET.DLL" at base 6edd0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 738a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6c960000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6c660000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6c610000 "AppLaunch.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6c390000 "AppLaunch.exe" loaded module "MSKEYPROTECT.DLL" at base 6c470000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6c230000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 744f0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f1e0000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 74480000 "AppLaunch.exe" loaded module "VAULTCLI.DLL" at base 6bea0000 "2tJ8730.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "2tJ8730.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "2tJ8730.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "2tJ8730.exe" loaded module "KERNEL32" at base 743b0000 "2tJ8730.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "2tJ8730.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74960000 "2tJ8730.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74960000 "2tJ8730.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74960000 "2tJ8730.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74960000 "2tJ8730.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 765e0000 "2tJ8730.exe" loaded module "NTDLL.DLL" at base 77590000 "2tJ8730.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e10000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76610000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72a40000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 73ef0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 765e0000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 73be0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72290000 "AppLaunch.exe" loaded module "USER32.DLL" at base 747e0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74960000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 72bd0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76ae0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 76d30000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70db0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 73f40000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76ae0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74960000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70d20000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 702c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73940000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6faa0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f990000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f210000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75110000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 731e0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 76560000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 6f150000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 766a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 6e9b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 6dd70000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 6c980000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 721c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 6c670000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 6c480000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6c2a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 6bf30000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6bee0000 "3CW36NV.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "3CW36NV.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "3CW36NV.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "3CW36NV.exe" loaded module "KERNEL32" at base 743b0000 "3CW36NV.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "3CW36NV.exe" loaded module "USER32" at base 747e0000 "3CW36NV.exe" loaded module "ADVAPI32" at base 76610000 "3CW36NV.exe" loaded module "SHELL32" at base 75110000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76560000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "schtasks.exe" loaded module "KERNEL32" at base 743b0000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 743b0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77220000 "schtasks.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73320000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 73ec000042:T559,"37303cf95e57208d991e49c540cba294.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F0000 "37303cf95e57208d991e49c540cba294.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 731E0000 "Ct3zm66.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F0000 "Ct3zm66.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 731E0000 "hf2WE47.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F0000 "hf2WE47.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 731E0000 "wM6yJ36.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F0000 "wM6yJ36.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 731E0000 "1Lz43pU7.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F0000 "1Lz43pU7.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 731E0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 731E0000 "2tJ8730.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F0000 "2tJ8730.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 731E0000 "3CW36NV.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F0000 "3CW36NV.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 731E0000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 744F000043:Tf3f,"37303cf95e57208d991e49c540cba294.exe" was detected as "Microsoft Cabinet" and name: "sfx" "37303cf95e57208d991e49c540cba294.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "37303cf95e57208d991e49c540cba294.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "37303cf95e57208d991e49c540cba294.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "37303cf95e57208d991e49c540cba294.exe" was detected as "Microsoft Linker" and name: "Linker" "1Lz43pU7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Lz43pU7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Lz43pU7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Lz43pU7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Lz43pU7.exe" was detected as "Microsoft Linker" and name: "Linker" "Ct3zm66.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Ct3zm66.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Ct3zm66.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Ct3zm66.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Ct3zm66.exe" was detected as "Microsoft Linker" and name: "Linker" "hf2WE47.exe" was detected as "Microsoft Cabinet" and name: "sfx" "hf2WE47.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "hf2WE47.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "hf2WE47.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "hf2WE47.exe" was detected as "Microsoft Linker" and name: "Linker" "wM6yJ36.exe" was detected as "Microsoft Cabinet" and name: "sfx" "wM6yJ36.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "wM6yJ36.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "wM6yJ36.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "wM6yJ36.exe" was detected as "Microsoft Linker" and name: "Linker" "4qv773ML.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4qv773ML.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4qv773ML.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4qv773ML.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4qv773ML.exe" was detected as "Microsoft Linker" and name: "Linker" "2tJ8730.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2tJ8730.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2tJ8730.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2tJ8730.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2tJ8730.exe" was detected as "Microsoft Linker" and name: "Linker" "5Hv1pF6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Hv1pF6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Hv1pF6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Hv1pF6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Hv1pF6.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "3CW36NV.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3CW36NV.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3CW36NV.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3CW36NV.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3CW36NV.exe" was detected as "Microsoft Linker" and name: "Linker"44:T48f,"AppLaunch.exe" touched "Group Policy Object" (Path: "HKCU\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}") "AppLaunch.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "AppLaunch.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "AppLaunch.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "AppLaunch.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "AppLaunch.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "AppLaunch.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "AppLaunch.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")45:T172d,"37303cf95e57208d991e49c540cba294.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1Lz43pU7.exe" file has an entrypoint instructions - "call 0x4058d9,jmp 0x404f9f,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x404ea9,jmp 0x40512b,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x42a01c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "Ct3zm66.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "hf2WE47.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "wM6yJ36.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4qv773ML.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "2tJ8730.exe" file has an entrypoint instructions - "call 0x4058d9,jmp 0x404f9f,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x404ea9,jmp 0x40512b,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x42a01c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "5Hv1pF6.exe" file has an entrypoint instructions - "call 0x4058d9,jmp 0x404f9f,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x404ea9,jmp 0x40512b,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x42a01c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "FANBooster131.exe" file has an entrypoint instructions - "call 0x40ff23,jmp 0x40f992,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x413014],bnd jne 0x40fb1b,bnd ret ,bnd jmp 0x40fb49,push ebp,mov ebp, esp,push 0,call dword ptr [0x415068],push dword ptr [ebp + 8],call dword ptr [0x415064],push 0xc0000409,call dword ptr [0x415014],push eax,call dword ptr [0x415008],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x410540,test eax, eax,je 0x40fb62,push 2,pop ecx,int 0x29," "3CW36NV.exe" file has an entrypoint instructions - "call 0x4032e6,jne 0x4032ed,je 0x4032ed,test eax, 0xeb5b9ba5,or al, byte ptr [ecx + eax*4 - 0x15],out 0x32, al,add byte ptr [eax], al,jmp 0x4032fe,and ch, bl,cmc ,inc esp,and dh, byte ptr [esi + eax + 0x75],add al, 0x94,push ss,xor dword ptr [ecx - 0x3dbbb39], ebx,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x403317,je 0x403317,dec ebp,lahf ,mov edx, dword ptr [esp],add esp, 4,jmp 0x403325,mov byte ptr [ecx], ch,shr bl, 5,test al, 0xeb,stc ,mov byte ptr [eax - 0x4373fa15], ch,shr bl, 1,pop es,add eax, dword ptr fs:[edx],je 0x40333c,jne 0x40333c,jb 0x40337c,and dh, byte ptr [esi],in eax, dx,push dword ptr [eax + 0xa4],jne 0x403349,"46:T654,"37303cf95e57208d991e49c540cba294.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "37303cf95e57208d991e49c540cba294.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "37303cf95e57208d991e49c540cba294.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Ct3zm66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Ct3zm66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Ct3zm66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "hf2WE47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "hf2WE47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "hf2WE47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wM6yJ36.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "wM6yJ36.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wM6yJ36.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Lz43pU7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2tJ8730.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")47:Tfff,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007908-00000C25-48895033] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00007908-00000C25-49027962] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007908-00000BC1-49070091] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00006380-00000BC1-49837878] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00001088-00000BC1-50551131] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003948-00000BC1-51255854] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001052-00000C25-56198186] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001052-00000C25-56922523] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001052-00000C25-57152368] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001052-00000C25-57292030] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001052-00000C25-57540032] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001052-00000C25-57624988] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001052-00000C25-57696475] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001052-00000C25-57830020] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001052-00000C25-58019459] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001052-00000C25-58266127] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001052-00000C25-58579066] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001052-00000C25-58927417] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001052-00000C25-59015415] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001052-00000C25-59126758] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001052-00000C25-59406044] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00001052-00000C25-60092832] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00001052-00000C25-60193780] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00001052-00000C25-60282967] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00001052-00000C25-60439503]48:T1682,"1Lz43pU7.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1Lz43pU7.exe]- [targetUID: 00000000-00003948] "Ct3zm66.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Ct3zm66.exe]- [targetUID: 00000000-00007908] "hf2WE47.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\hf2WE47.exe]- [targetUID: 00000000-00006380] "wM6yJ36.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\wM6yJ36.exe]- [targetUID: 00000000-00003948] "4qv773ML.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4qv773ML.exe]- [targetUID: 00000000-00006380] "2tJ8730.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2tJ8730.exe]- [targetUID: 00000000-00003948] "5Hv1pF6.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5Hv1pF6.exe]- [targetUID: 00000000-00007908] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00000408] "3CW36NV.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3CW36NV.exe]- [targetUID: 00000000-00001040] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Wed Nov 29 14:50:20 2023 mtime=Wed Nov 29 14:50:20 2023 atime=Fri Feb 28 08:36:45 2020 length=102568 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00000408] "3b6N2Xdh3CYwplaces.sqlite" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\3b6N2Xdh3CYwplaces.sqlite]- [targetUID: 00000000-00000408] "02zdBXl47cvzcookies.sqlite" has type "SQLite 3.x database user version 9 last written using SQLite version 3020001"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\02zdBXl47cvzcookies.sqlite]- [targetUID: 00000000-00000408] "8ghN89CsjOW1formhistory.sqlite" has type "SQLite 3.x database user version 4 last written using SQLite version 3020001"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\8ghN89CsjOW1formhistory.sqlite]- [targetUID: 00000000-00000408] "IWPfiAXUTJTSHistory" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\IWPfiAXUTJTSHistory]- [targetUID: 00000000-00000408] "3b6N2Xdh3CYwWeb Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\3b6N2Xdh3CYwWeb Data]- [targetUID: 00000000-00000408] "Ei8DrAmaYu9KLogin Data" has type "SQLite 3.x database last written using SQLite version 3038005"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\Ei8DrAmaYu9KLogin Data]- [targetUID: 00000000-00000408] "oOPEmFmu_xsJCookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\oOPEmFmu_xsJCookies]- [targetUID: 00000000-00000408] "c7beXDz83vuCf_OztMgUeu8JtkMBa437.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\c7beXDz83vuCf_OztMgUeu8JtkMBa437.zip]- [targetUID: 00000000-00000408] "Firefox_ywzu7870.default.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\grandUIA7V4P1WC8j2P1l\Cookies\Firefox_ywzu7870.default.txt]- [targetUID: 00000000-00000408] "Edge_Default.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\grandUIA7V4P1WC8j2P1l\Cookies\Edge_Default.txt]- [targetUID: 00000000-00000408] "Registry.pol" has type "data"- Location: [%WINDIR%\System32\GroupPolicy\Machine\Registry.pol]- [targetUID: 00000000-00000408] "passwords.txt" has type "UTF-8 Unicode text with CRLF line terminators"- Location: [%TEMP%\grandUIA7V4P1WC8j2P1l\passwords.txt]- [targetUID: 00000000-00000408] "information.txt" has type "ASCII text"- Location: [%TEMP%\grandUIA7V4P1WC8j2P1l\information.txt]- [targetUID: 00000000-00000408] "Edge_Default.txt" has type "ASCII text"- Location: [%TEMP%\grandUIA7V4P1WC8j2P1l\Downloads\Edge_Default.txt]- [targetUID: 00000000-00000408] "gpt.ini" has type "ASCII text with CRLF line terminators"- Location: [%WINDIR%\System32\GroupPolicy\gpt.ini]- [targetUID: 00000000-00000408] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00000408] "gpt.ini" has type "ASCII text with CRLF line terminators"- Location: [%WINDIR%\SysWOW64\GroupPolicy\gpt.ini]- [targetUID: 00000000-00000408] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00000408] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00000408] "D87fZN3R3jFeplaces.sqlite" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\D87fZN3R3jFeplaces.sqlite]- [targetUID: 00000000-00000408] "02zdBXl47cvzHistory" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\02zdBXl47cvzHistory]- [targetUID: 00000000-00000408] "D87fZN3R3jFeWeb Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\posterBox7V4P1WC8j2P1l\D87fZN3R3jFeWeb Data]- [targetUID: 00000000-00000408]49:T64a,"37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")4a:T51e,"37303cf95e57208d991e49c540cba294.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ct3zm66.exe" (UID: 7908) "Ct3zm66.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\hf2WE47.exe" (UID: 6380) "hf2WE47.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\wM6yJ36.exe" (UID: 1088) "hf2WE47.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3CW36NV.exe" (UID: 1088) "wM6yJ36.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1Lz43pU7.exe" (UID: 3948) "wM6yJ36.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2tJ8730.exe" (UID: 3948) "1Lz43pU7.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7112) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 408) "AppLaunch.exe" queries basic process information of the "C:\Windows\SysWOW64\schtasks.exe" (UID: 408) "2tJ8730.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7176)4b:Tc75,"37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "37303CF95E57208D991E49C540CBA294.EXE"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")4c:T526,"AppLaunch.exe" reads file "c:\windows\syswow64\grouppolicy\gpt.ini" "AppLaunch.exe" reads file "c:\windows\system32\grouppolicy\gpt.ini" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "AppLaunch.exe" reads file "c:\users\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\music\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\links\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\saved games\desktop.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles.ini" "AppLaunch.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\signons.sqlite"4d:Tc51,"37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CT3ZM66.EXE" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ct3zm66.exe" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5HV1PF6.EXE" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5Hv1pF6.exe" "Ct3zm66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Ct3zm66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "Ct3zm66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "Ct3zm66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "Ct3zm66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\HF2WE47.EXE" "Ct3zm66.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\hf2WE47.exe" "Ct3zm66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4QV773ML.EXE" "Ct3zm66.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4qv773ML.exe" "hf2WE47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "hf2WE47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "hf2WE47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "hf2WE47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "hf2WE47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\WM6YJ36.EXE" "hf2WE47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\wM6yJ36.exe" "hf2WE47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3CW36NV.EXE" "hf2WE47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3CW36NV.exe" "wM6yJ36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"4e:T808,"37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "\Device\HarddiskVolume2\37303CF95E57208D991E49C540CBA294.EXE.LOCAL" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "37303cf95e57208d991e49c540cba294.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Ct3zm66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CT3ZM66.EXE.LOCAL" "Ct3zm66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Ct3zm66.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "hf2WE47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\HF2WE47.EXE.LOCAL" "hf2WE47.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "hf2WE47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "wM6yJ36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\WM6YJ36.EXE.LOCAL" "wM6yJ36.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "wM6yJ36.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\APPLAUNCH.EXE.LOCAL" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAXLOONAFEST131" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\FANBOOSTER131" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBOOSTER131.LNK"4f:T4ad,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00000408-00000C26-60499425") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00000408-00000C26-60499533") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00000408-00000C26-60499660") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00000408-00000C26-60499763") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00000408-00000C26-60499763") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00000408-00000C26-60499763") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00000408-00000C26-60500023") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00000408-00000C26-60500023") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00000408-00000C26-60500195") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000408-00000C26-62006306")50:Tc84,Heuristic match: "qVs.aM" Heuristic match: "r,WkWLE.PF" Heuristic match: "_9.tz" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XL0J0H" Pattern match: "support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.InZDa42Ct3F8+https://app.vssps.visualstudio.com/_signin?realm=my.visualstudio.com&reply_to=https%3A%2F%2Fmy.visualstudio.com%2FBenefits%3Fwt.mc_id%3Do~msft~vscom~nav%26campaign%3Do~msft~vscom~na" Pattern match: "8vUumicrosoft.comMUID12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comFedAuth1d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUN" Pattern match: "learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170Latest" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "www.clarity.msCLIDv10" Pattern match: "https://t.me/RiseProSUPPORT" Pattern match: "www.office.comTRUE/TRUE1682703223OH.FLIDENC893*_djEws8NdG3GbU3IL5qBxIay96qeF45znSVZ0q2qNOjV2pyKLJ1JS3oXVShK4MB0sKCsb9QE4iVD2Ite0T6viZwF/+Q==_tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=*.facebook.comTRUE/TRUE1714239222sbENC893*_djEwNJ0hGL4hIdBgxqJ6FWeVt3mf" Pattern match: "notepad-plus-plus.org/downloads/v8.4.7/C:\Users\HAPUBWS\Downloads\npp.8.4.7.portable.x64.ziphttps://notepad-plus-plus.org/downloads/v8.4.7/C:\Users\HAPUBWS\Downloads\VC_redist.x86.exehttps://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?" Heuristic match: "ipinfo.io" Pattern match: "www.google.comFALSE/FALSE1531831057DVgw7SsgaDfBIQ0N8QXx_eM9eFGkqDShY" Pattern match: "www.office.comTRUE/TRUE1682703223OH.FLIDENC893*_djEws8NdG3GbU3IL5qBxIay96qeF45znSVZ0q2qNOjV2pyKLJ1JS3oXVShK4MB0sKCsb9QE4iVD2Ite0T6viZwF/+Q==_tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=*" Pattern match: "www.clarity.msTRUE/TRUE1700603814CLIDENC893*_djEwXezimZY+UCtv72pFXMe91KqF7G3hkI4VyS6rMKN9PUGaPD4or63nWxLdr7DdICVLVRb4xHwTfS/unwiEtQEkfMoepLq5owBtG89DfjZo_tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=*" Pattern match: "www.bing.comTRUE/FALSE1712155557MUIDBENC893*_djEw4urjEw1joXvJGUkuBOttk3Zt5cvSNq2TsqL1CmPvjzf08Xufaogz986sf//gNHOKhGhY6OKnQaDhM2Xf_tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=*" Pattern match: "www2.bing.comTRUE/FALSE1712155558MUIDBENC893*_djEw9rUzoyNmBGzKT4gBIZDDOFQxKwKEVlEdz3sxEho5kXbPbfD3p/8XfBoUhMK3xKsZCB/voaWlz53+y2dH_tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=*" Pattern match: "https://ipinfo.io/" Heuristic match: "%TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com" Heuristic match: "%TEMP%\grandUIA7V4P1WC8j2P1l\Files\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\omextemplates.content.office.net" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "<_.kz" Heuristic match: "$[S.Mc" Heuristic match: "4'.GH" Heuristic match: "bd.eU"51:T556,"wM6yJ36.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00003948) "wM6yJ36.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003948) "AppLaunch.exe" called "FindFirstFileA" with parameter %TEMP%\grandUIA7V4P1WC8j2P1l\Autofill\*.* (UID: 00000000-00000408) "AppLaunch.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00000408) "AppLaunch.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Desktop/\* (UID: 00000000-00000408) "AppLaunch.exe" called "FindNextFileA" with parameter desktop.ini (UID: 00000000-00000408) "AppLaunch.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Documents/\* (UID: 00000000-00000408) "AppLaunch.exe" called "FindNextFileA" with parameter Database1.accdb (UID: 00000000-00000408) "AppLaunch.exe" called "FindNextFileA" with parameter My Music (UID: 00000000-00000408) "AppLaunch.exe" called "FindNextFileA" with parameter My Pictures (UID: 00000000-00000408) "AppLaunch.exe" called "FindNextFileA" with parameter My Videos (UID: 00000000-00000408) "AppLaunch.exe" called "FindNextFileA" with parameter OneNote Notebooks (UID: 00000000-00000408) "AppLaunch.exe" called "FindNextFileA" with parameter Outlook Files (UID: 00000000-00000408) "AppLaunch.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Documents/\My Music\* (UID: 00000000-00000408)52:T9fb,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")53:T4cc,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")54:T8a4,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")55:T4e1,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")56:Td06,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")57:T4c3,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "37303cf95e57208d991e49c540cba294.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "37303cf95e57208d991e49c540cba294.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")58:T4df,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\hf2WE47.exe" (Indicator: "\Device\"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp")59:T70a,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")5a:T5b0,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")5b:T723,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "37303cf95e57208d991e49c540cba294.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001088.00000001.69858.00F21000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001088.00000001.69858.00F21000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")5c:T5da,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")5d:Tbf0,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "37303cf95e57208d991e49c540cba294.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00001040.00000001.70201.032F0000.00000004.mdmp, 00000000-00001040.00000002.72122.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00001088.00000000.67936.00940000.00000004.mdmp, 00000000-00001088.00000001.69858.00940000.00000004.mdmp, 00000000-00001088.00000002.71779.00940000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00001088.00000001.69858.00F2A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00006380.00000000.67892.0038A000.00000002.mdmp")5e:T1477,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 37303cf95e57208d991e49c540cba294.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 37303cf95e57208d991e49c540cba294.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 37303cf95e57208d991e49c540cba294.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 37303cf95e57208d991e49c540cba294.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 37303cf95e57208d991e49c540cba294.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Ct3zm66.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Ct3zm66.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Ct3zm66.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Ct3zm66.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Ct3zm66.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: hf2WE47.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: hf2WE47.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: hf2WE47.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: hf2WE47.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: hf2WE47.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: wM6yJ36.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: wM6yJ36.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: wM6yJ36.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: wM6yJ36.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: wM6yJ36.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4qv773ML.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 4qv773ML.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 4qv773ML.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 4qv773ML.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 4qv773ML.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 4qv773ML.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4qv773ML.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4qv773ML.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 4qv773ML.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 4qv773ML.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 4qv773ML.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 4qv773ML.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 4qv773ML.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 4qv773ML.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 4qv773ML.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 4qv773ML.exe]5f:Te86,"37303cf95e57208d991e49c540cba294.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\CT3ZM66.EXE"; Value: "") "Ct3zm66.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\HF2WE47.EXE"; Value: "") "hf2WE47.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\WM6YJ36.EXE"; Value: "") "hf2WE47.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\3CW36NV.EXE"; Value: "") "wM6yJ36.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1LZ43PU7.EXE"; Value: "") "wM6yJ36.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2TJ8730.EXE"; Value: "") "1Lz43pU7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "1Lz43pU7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")60:T563,"1Lz43pU7.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1Lz43pU7.exe]- [targetUID: 00000000-00003948] "Ct3zm66.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Ct3zm66.exe]- [targetUID: 00000000-00007908] "hf2WE47.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\hf2WE47.exe]- [targetUID: 00000000-00006380] "wM6yJ36.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\wM6yJ36.exe]- [targetUID: 00000000-00003948] "4qv773ML.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4qv773ML.exe]- [targetUID: 00000000-00006380] "2tJ8730.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2tJ8730.exe]- [targetUID: 00000000-00003948] "5Hv1pF6.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5Hv1pF6.exe]- [targetUID: 00000000-00007908] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00000408] "3CW36NV.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3CW36NV.exe]- [targetUID: 00000000-00001040]61:T41e,"37303cf95e57208d991e49c540cba294.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Ct3zm66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "hf2WE47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "wM6yJ36.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1Lz43pU7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "2tJ8730.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "3CW36NV.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")62:T453,"AppLaunch.exe" reads file "C:\Windows\SysWOW64\GroupPolicy\gpt.ini" "AppLaunch.exe" reads file "C:\Windows\System32\GroupPolicy\gpt.ini" "AppLaunch.exe" reads file "C:\Users\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "AppLaunch.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini"63:T6d8,"1Lz43pU7.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1Lz43pU7.exe]- [targetUID: 00000000-00003948] "Ct3zm66.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Ct3zm66.exe]- [targetUID: 00000000-00007908] "hf2WE47.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\hf2WE47.exe]- [targetUID: 00000000-00006380] "wM6yJ36.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\wM6yJ36.exe]- [targetUID: 00000000-00003948] "4qv773ML.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4qv773ML.exe]- [targetUID: 00000000-00006380] "2tJ8730.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2tJ8730.exe]- [targetUID: 00000000-00003948] "5Hv1pF6.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5Hv1pF6.exe]- [targetUID: 00000000-00007908] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00000408] "3CW36NV.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3CW36NV.exe]- [targetUID: 00000000-00001040] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00000408] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00000408]64:T652,"37303cf95e57208d991e49c540cba294.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "37303cf95e57208d991e49c540cba294.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Ct3zm66.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Ct3zm66.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "hf2WE47.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "hf2WE47.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "wM6yJ36.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "wM6yJ36.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "AppLaunch.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")65:T116d,"37303cf95e57208d991e49c540cba294.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ct3zm66.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "37303cf95e57208d991e49c540cba294.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5Hv1pF6.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Ct3zm66.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\hf2WE47.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Ct3zm66.exe" wrote 31232 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4qv773ML.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "hf2WE47.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\wM6yJ36.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "hf2WE47.exe" wrote 27136 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3CW36NV.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "wM6yJ36.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1Lz43pU7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "wM6yJ36.exe" wrote 10464 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2tJ8730.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "AppLaunch.exe" wrote 37032 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "AppLaunch.exe" wrote 37032 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\FANBooster131\FANBooster131.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "AppLaunch.exe" wrote 37032 bytes starting with PE header signature to file "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...66:Te2c,"AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "8000000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "9000000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a000000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b000000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c000000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d000000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e000000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f000000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "0001000060e40e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "1001000060e40e03" "pDataOut": "20000000e00ebf05" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "8000000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "9000000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a000000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b000000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c000000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d000000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e000000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f000000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "0001000000e00e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "1001000000e00e03" "pDataOut": "20000000e00bbf05" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000b8dc0e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000b8dc0e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000b8dc0e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000b8dc0e03" "pDataOut": "0000000000000000" "$error": "d"} "AppLaunch.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000b8dc0e03" "pDataOut": "0000000000000000" "$error": "d"}67:T7df,"wM6yJ36.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2tJ8730.exe" for deletion "wM6yJ36.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1Lz43pU7.exe" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\8ghN89CsjOW1formhistory.sqlite" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\Ei8DrAmaYu9KLogin Data" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\D87fZN3R3jFeplaces.sqlite" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\02zdBXl47cvzcookies.sqlite" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\D87fZN3R3jFeWeb Data" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\02zdBXl47cvzHistory" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\3b6N2Xdh3CYwWeb Data" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\oOPEmFmu_xsJCookies" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\IWPfiAXUTJTSHistory" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\c7beXDz83vuCf_OztMgUeu8JtkMBa437.zip" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA7V4P1WC8j2P1l\Cookies\Edge_Default.txt" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA7V4P1WC8j2P1l\Cookies\Firefox_ywzu7870.default.txt" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA7V4P1WC8j2P1l\Downloads\Edge_Default.txt" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA7V4P1WC8j2P1l\information.txt" for deletion "AppLaunch.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA7V4P1WC8j2P1l\passwords.txt" for deletion68:Tb58,"37303cf95e57208d991e49c540cba294.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Ct3zm66.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Ct3zm66.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "hf2WE47.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "hf2WE47.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "hf2WE47.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "wM6yJ36.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "wM6yJ36.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "wM6yJ36.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "wM6yJ36.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "wM6yJ36.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2tJ8730.exe" with delete access "wM6yJ36.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1Lz43pU7.exe" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\8ghN89CsjOW1formhistory.sqlite" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\Ei8DrAmaYu9KLogin Data" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\D87fZN3R3jFeplaces.sqlite" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\02zdBXl47cvzcookies.sqlite" with delete access "AppLaunch.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\3b6N2Xdh3CYwplaces.sqlite" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\D87fZN3R3jFeWeb Data" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\02zdBXl47cvzHistory" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\3b6N2Xdh3CYwWeb Data" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\oOPEmFmu_xsJCookies" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox7V4P1WC8j2P1l\IWPfiAXUTJTSHistory" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\c7beXDz83vuCf_OztMgUeu8JtkMBa437.zip" with delete access "AppLaunch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA7V4P1WC8j2P1l\Cookies\Edge_Default.txt" with delete access69:T6f2,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA GetModuleFileNameW GetCommandLineW LoadLibraryExW GetCommandLineA GetFileSizeEx FindNextFileW ExitThread FindFirstFileExW CreateFileW IsDebuggerPresent GetModuleHandleExW RegCreateKeyExW CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW GetFileAttributesW FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetSystemDirectoryW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW GetFileSize OpenProcess ReadProcessMemory CreateDirectoryW DeleteFileW GetTempFileNameW GetComputerNameW FindFirstFileW VirtualAllocEx Process32NextW CopyFileExW Process32FirstW GetTempPathW CreateProcessW VirtualAlloc ShellExecuteW ShellExecuteExW GetCursorPos GetClipboardData SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto VirtualProtect SleepEx6a:T41b,22/72 Antivirus vendors marked dropped file "1Lz43pU7.exe" as malicious (classified as "VHO:Backdoor.Agent" with 30% detection rate) 44/72 Antivirus vendors marked dropped file "Ct3zm66.exe" as malicious (classified as "Smokeloader.J" with 61% detection rate) 44/72 Antivirus vendors marked dropped file "hf2WE47.exe" as malicious (classified as "Smokeloader.J" with 61% detection rate) 30/72 Antivirus vendors marked dropped file "wM6yJ36.exe" as malicious (classified as "TrojanSpy.TRICKBOT" with 41% detection rate) 14/72 Antivirus vendors marked dropped file "4qv773ML.exe" as malicious (classified as "Malware.Generic" with 19% detection rate) 25/72 Antivirus vendors marked dropped file "2tJ8730.exe" as malicious (classified as "TrojanSpy.TRICKBOT" with 34% detection rate) 18/50 Antivirus vendors marked dropped file "5Hv1pF6.exe" as malicious (classified as "TrojanSpy.TRICKBOT" with 36% detection rate) 48/69 Antivirus vendors marked dropped file "3CW36NV.exe" as malicious (classified as "Trojan.SmokeLoader" with 69% detection rate)6b:T937,"37303cf95e57208d991e49c540cba294.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Ct3zm66.exe" (Handle: 652) "Ct3zm66.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\hf2WE47.exe" (Handle: 656) "hf2WE47.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\wM6yJ36.exe" (Handle: 656) "hf2WE47.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3CW36NV.exe" (Handle: 652) "wM6yJ36.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1Lz43pU7.exe" (Handle: 624) "wM6yJ36.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2tJ8730.exe" (Handle: 124) "1Lz43pU7.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "1Lz43pU7.exe" wrote 00000400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "1Lz43pU7.exe" wrote 00136000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "1Lz43pU7.exe" wrote 00035C00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "1Lz43pU7.exe" wrote 00002200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "1Lz43pU7.exe" wrote 00000600 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "1Lz43pU7.exe" wrote 00009600 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "AppLaunch.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1064) "AppLaunch.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1080) "2tJ8730.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "2tJ8730.exe" wrote 0000AA00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "2tJ8730.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140)6c:T510,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{C9EC87C4-352B-41BD-B837-ABDAE7A27329}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEBEHAVIORMONITORING"; Value: "01000000") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{C9EC87C4-352B-41BD-B837-ABDAE7A27329}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEONACCESSPROTECTION"; Value: "01000000") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{C9EC87C4-352B-41BD-B837-ABDAE7A27329}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLESCANONREALTIMEENABLE"; Value: "01000000") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{C9EC87C4-352B-41BD-B837-ABDAE7A27329}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{C9EC87C4-352B-41BD-B837-ABDAE7A27329}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEIOAVPROTECTION"; Value: "01000000")6d:T428,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL")6e:T6e6,"AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "AppLaunch.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\LOGINS.JSON" "AppLaunch.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\SIGNONS.SQLITE" "AppLaunch.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\SIGNONS.SQLITE-JOURNAL" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite" "AppLaunch.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOCAL STATE" "AppLaunch.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOCALPREFS.JSON" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "AppLaunch.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\LOGIN DATA FOR ACCOUNT" "AppLaunch.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\LOGIN DATA FOR ACCOUNT-JOURNAL" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite"6f:Te8e,AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask70:T4ac,Spawned process "37303cf95e57208d991e49c540cba294.exe" (UID: 00000000-00007908) Spawned process "Ct3zm66.exe" (UID: 00000000-00006380) Spawned process "hf2WE47.exe" (UID: 00000000-00001088) Spawned process "wM6yJ36.exe" (UID: 00000000-00003948) Spawned process "1Lz43pU7.exe" (UID: 00000000-00007112) Spawned process "AppLaunch.exe" (UID: 00000000-00000408) Spawned process "2tJ8730.exe" (UID: 00000000-00007176) Spawned process "AppLaunch.exe" (UID: 00000000-00001052) Spawned process "3CW36NV.exe" (UID: 00000000-00001040) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" (UID: 00000000-00004024) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" (UID: 00000000-00001508) Spawned process "WerFault.exe" with commandline "-pss -s 456 -p 408 -ip 408" (UID: 00000000-00005944) Spawned process "WerFault.exe" with commandline "-u -p 408 -s 2080" (UID: 00000000-00004908)71:T410,"2tJ8730.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "2tJ8730.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "2tJ8730.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "2tJ8730.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "2tJ8730.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "2tJ8730.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "2tJ8730.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK")72:T243a,Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"73:Ta5d,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00001604.00000000.69084.01011000.00000020.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00001604.00000000.69084.01011000.00000020.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00001604.00000000.69084.01011000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001604.00000000.69084.0102D000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001604.00000000.69084.0102D000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001604.00000000.69084.0102D000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001604.00000000.69084.0102D000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001604.00000000.69084.0102D000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001604.00000000.69084.0102D000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002548.00000000.67020.001FD000.00000002.mdmp, 00000000-00002548.00000000.67027.0020A000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002548.00000000.67020.001FD000.00000002.mdmp, 00000000-00002548.00000000.67027.0020A000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002548.00000000.67020.001FD000.00000002.mdmp, 00000000-00002548.00000000.67027.0020A000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002548.00000000.67020.001FD000.00000002.mdmp, 00000000-00002548.00000000.67027.0020A000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002548.00000000.67020.001FD000.00000002.mdmp, 00000000-00002548.00000000.67027.0020A000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002548.00000000.67020.001FD000.00000002.mdmp, 00000000-00002548.00000000.67027.0020A000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002548.00000000.67027.0020A000.00000004.mdmp")74:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")75:T18c2,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00000960.00000001.68722.02AD0000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?") "CREATE TABLE sqlite_master(" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00002548.00000000.67027.0020A000.00000004.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")76:T10bd,"enforce_policyccpapaypal.com/102598702912031146405152208635531072978cookie_checkpaypal.com/9217416850124831807837152302235731072978d_id040ec45a14b744b9be64cd3f6ac1c76b1701269585589paypal.com/9217416850124831807837152411435931072978LANGen_US%3BUSpaypal.com/921798812531231073053152411435931072978tsrceunifiedloginnodewebpaypal.com/9217108545843231073583152411435931072978l7_azdcg02.phxpaypal.com/9217407583603231072983152427035931072978vreXpYrS%3D1795963985%26vteXpYrS%3D1701271385%26vr%3D1b91be7918c0a798887188f2faebb6d7%26vt%3D1b91be7918c0a798887188f2faebb6d6%26vtyp%3Dnewpaypal.com/921774464422431293256152458236031072978ts_cvr%3D1b91be7918c0a798887188f2faebb6d7%26vt%3D1b91be7918c0a798887188f2faebb6d6paypal.com/102574464422431293256152520636131072978" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102598702912031146405152208635531072978cookie_checkpaypal.com/9217416850124831807837152302235731072978d_id040ec45a14b744b9be64cd3f6ac1c76b1701269585589paypal.com/9217416850124831807837152411435931072978LANGen_US%3BUSpaypal.com/921798812531231073053152411435931072978tsrceunifiedloginnodewebpaypal.com/9217108545843231073583152411435931072978l7_azdcg02.phxpaypal.com/9217407583603231072983152427035931072978vreXpYrS%3D1795963985%26vteXpYrS%3D1701271385%26vr%3D1b91be7918c0a798887188f2faebb6d7%26vt%3D1b91be7918c0a798887188f2faebb6d6%26vtyp%3Dnewpaypal.com/921774464422431293256152458236031072978" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102598702912031146405152208635531072978cookie_checkpaypal.com/9217416850124831807837152302235731072978d_id040ec45a14b744b9be64cd3f6ac1c76b1701269585589paypal.com/9217416850124831807837152411435931072978LANGen_US%3BUSpaypal.com/921798812531231073053152411435931072978tsrceunifiedloginnodewebpaypal.com/9217108545843231073583152411435931072978l7_azdcg02.phxpaypal.com/9217407583603231072983152427035931072978" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102598702912031146405152208635531072978cookie_checkpaypal.com/9217416850124831807837152302235731072978d_id040ec45a14b744b9be64cd3f6ac1c76b1701269585589paypal.com/9217416850124831807837152411435931072978LANGen_US%3BUSpaypal.com/921798812531231073053152411435931072978tsrceunifiedloginnodewebpaypal.com/9217108545843231073583152411435931072978" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102598702912031146405152208635531072978cookie_checkpaypal.com/9217416850124831807837152302235731072978d_id040ec45a14b744b9be64cd3f6ac1c76b1701269585589paypal.com/9217416850124831807837152411435931072978LANGen_US%3BUSpaypal.com/921798812531231073053152411435931072978" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102598702912031146405152208635531072978cookie_checkpaypal.com/9217416850124831807837152302235731072978d_id040ec45a14b744b9be64cd3f6ac1c76b1701269585589paypal.com/9217416850124831807837152411435931072978" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102598702912031146405152208635531072978cookie_checkpaypal.com/9217416850124831807837152302235731072978" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102598702912031146405152208635531072978" (Indicator: "paypal.com") "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "b6d6; Path=/; Domain=paypal.com; Expires=Sat, 28 Nov 2026 14:53:05 GMT; SecureTraceparent: 00-0000000000000000000f368508df9d88-7a0840823e9b892a-01X-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=blockDC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesVia: 1.1 varnish, 1.1 varnish, 1.1 varnishDate: Wed, 29 Nov 2023 14:53:05 GMTStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Served-By: cache-bur-kbur8200171-BUR, cache-sjc10047-SJC, cache-sjc10047-SJCX-Cache: MISS, MISS, MISSX-Cache-Hits: 0, 0, 0X-Timer: S1701269586.508410,VS0,VE168Vary: Accept-EncodingServer-Timing: "traceparent;desc="00-0000000000000000000f368508df9d88-09d41a608ed0876b-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"transfer-encoding: chunked" (Indicator: "paypal.com") "ttps://www.paypal.com/signin" (Indicator: "paypal.com")77:T1995,"GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 29 Nov 2023 14:52:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 29 Nov 2023 14:52:38 GMT Server: cloudflare CF-RAY: 82dbac969ccc1688-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 14:31:06 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1311 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 14:31:06 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1313 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 14:30:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1367 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 29 Nov 2023 14:10:13 GMT Expires: Wed 29 Nov 2023 15:00:13 GMT Cache-Control: public max-age=3000 Age: 2567 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 14:05:22 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2859 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12135 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 29 Nov 2023 14:45:29 GMT Expires: Wed 29 Nov 2023 15:35:29 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 29 Nov 2023 13:04:51 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 452 with response body ==>30822F6330822E4B020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 14:30:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1369 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 14:16:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2220 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......78:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")79:T411b,Found requests in header "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:oz5yWTCXp0XMYMS-KFnCStcvZ3Bkhw:KFpf70_TukuCHHmiConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp21uu_3jVMtiE-1xrMM4oPuhCDP0O2dBXnQ3b6Fe5VRCY2ANEA7e0BhYyLJcrZCVV-eWcmQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:OCFaQ-rVbiwS-IXq7iu8mfwizkM5_g:Elyomi8rZZVOUoa4Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxBRB-pSiV5I7gzgezv5ScogfG5pJICc89uo11Rfkx99KINYSZ_8pnh9B8SKYGTJNZF-2bw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-133805523%3A1701269579443107&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:OCFaQ-rVbiwS-IXq7iu8mfwizkM5_g:Elyomi8rZZVOUoa4Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:OCFaQ-rVbiwS-IXq7iu8mfwizkM5_g:Elyomi8rZZVOUoa4"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1hRkFmcePIECjAXK_JU8MvkkAebv2QlOurJ4BHIygQb5zo0PwGoPF3RE-DNu2FQLM-J3N3Ug HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:z-bHefwIZ70f-57O7YCv98jYPOiaNQ:ubJa857fqaka3C6VConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:z-bHefwIZ70f-57O7YCv98jYPOiaNQ:ubJa857fqaka3C6V"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3aLqPD5V_Bs1jre2Ppus9J2ZRgXos5lIn4D1BQBhCkZzetpjJhpcpeCpWnKu9wU_84RseI&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107484416%3A1701269585021166&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:zD9-k0cZqyOklBLXq7BoqmdoezWR4Q:MQ48cgBPR4zjJ3g6"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:zD9-k0cZqyOklBLXq7BoqmdoezWR4Q:MQ48cgBPR4zjJ3g6"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-8250076401239804003&bl=boq_identityfrontendauthuiserver_20231112.08_p0&hl=en-US&_reqid=56595&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-133805523:1701269579443107",null,null,"ASKXGp2hxBRB-pSiV5I7gzgezv5ScogfG5pJICc89uo11Rfkx99KINYSZ_8pnh9B8SKYGTJNZF-2bw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:zD9-k0cZqyOklBLXq7BoqmdoezWR4Q:MQ48cgBPR4zjJ3g6; OTZ=7316083_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:zD9-k0cZqyOklBLXq7BoqmdoezWR4Q:MQ48cgBPR4zjJ3g6; OTZ=7316083_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=2394986742170353579&bl=boq_identityfrontendauthuiserver_20231112.08_p0&hl=en-US&_reqid=56595&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1107484416:1701269585021166",null,null,"ASKXGp3aLqPD5V_Bs1jre2Ppus9J2ZRgXos5lIn4D1BQBhCkZzetpjJhpcpeCpWnKu9wU_84RseI"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:zD9-k0cZqyOklBLXq7BoqmdoezWR4Q:MQ48cgBPR4zjJ3g6; OTZ=7316083_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:NmbMtVVhStF7j0_AO3MATn9UvqNd2Q:dRglr-nS-e_NF229; OTZ=7316083_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?nRp9jA HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:NmbMtVVhStF7j0_AO3MATn9UvqNd2Q:dRglr-nS-e_NF229; OTZ=7316083_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?5Kvs8g HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:NmbMtVVhStF7j0_AO3MATn9UvqNd2Q:dRglr-nS-e_NF229; OTZ=7316083_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: store.steampowered.comDNT: 1Connection: Keep-AliveCookie: steamCountry=US%7Cd5203a3b374fc04fbcd23a13412805b3; browserid=3212818064318380648; sessionid=595e28eb2c4ab8ec390910c4"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/am=jwgrInFsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFUxVp2QZfgdBiFjMB6ZInV2gxjIQ/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/am=jwgrInNsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGJuEg-xoK66etGiI8y4I8ZrOsmVw/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/ck=boq-identity.AccountsSignInUi.FalVefT2r2I.L.I11.O/am=jwgrInFsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGRrKd0yRT69HSrrhL_2i_tMhEbkA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/ck=boq-identity.AccountsSignInUi.FalVefT2r2I.L.I11.O/am=jwgrInFsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGRrKd0yRT69HSrrhL_2i_tMhEbkA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/ck=boq-identity.AccountsSignInUi.FalVefT2r2I.L.I11.O/am=jwgrInFsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGRrKd0yRT69HSrrhL_2i_tMhEbkA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/ck=boq-identity.AccountsSignInUi.FalVefT2r2I.L.I11.O/am=jwgrInNsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGraYfWg3ET9pto8gs7lOLwM4AYpg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.bymDw_vyWXs.es5.O/ck=boq-identity.AccountsSignInUi.FalVefT2r2I.L.I11.O/am=jwgrInNsAMT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGraYfWg3ET9pto8gs7lOLwM4AYpg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")7a:T86b8,"GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" "HTTP/1.1 200 OKDate: Wed, 29 Nov 2023 14:52:23 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: keep-alivex-iplb-request-id: AC45869E:CAA4_93878F2E:0050_65675027_22FFB59:0402x-iplb-instance: 30783CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v6x%2FjbXbGL6RY5%2BsPIOCNUf9%2BoDyfX8EMQEfiJmQSr0zuU%2FuQIgmzhOUsjHNvuC%2BruUn7F%2FQBnZglpXSnFI1cpvrgm8qk75mDbHOSRHHhYkQQsMecjPvWbjTWw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 82dbac95882967e2-SJCalt-svc: h3=":443"; ma=864004f{"status":"ok","demoInfo":{"error":"over query limit please try again later"}}" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:oz5yWTCXp0XMYMS-KFnCStcvZ3Bkhw:KFpf70_TukuCHHmiConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:oz5yWTCXp0XMYMS-KFnCStcvZ3Bkhw:KFpf70_TukuCHHmi;Path=/;Expires=Fri, 28-Nov-2025 14:52:58 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-Y4pVmmwGFJgFasMyhoEbUw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Wed, 29 Nov 2023 14:52:58 GMTExpires: Wed, 29 Nov 2023 14:52:58 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j00000001�0000000100000000100000001�00000001�00000001d9B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:OCFaQ-rVbiwS-IXq7iu8mfwizkM5_g:Elyomi8rZZVOUoa4; Expires=Fri 28-Nov-2025 14:52:59 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Wed 29 Nov 2023 14:52:59 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp21uu_3jVMtiE-1xrMM4oPuhCDP0O2dBXnQ3b6Fe5VRCY2ANEA7e0BhYyLJcrZCVV-eWcmQStrict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-F2pWZwhP31Mkd7ChIDjIlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Cross-Origin-Resource-Policy: cross-originAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp21uu_3jVMtiE-1xrMM4oPuhCDP0O2dBXnQ3b6Fe5VRCY2ANEA7e0BhYyLJcrZCVV-eWcmQ HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:OCFaQ-rVbiwS-IXq7iu8mfwizkM5_g:Elyomi8rZZVOUoa4Connection: Keep-AliveAccept-Language: en-US", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxBRB-pSiV5I7gzgezv5ScogfG5pJICc89uo11Rfkx99KINYSZ_8pnh9B8SKYGTJNZF-2bw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-133805523%3A1701269579443107&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:OCFaQ-rVbiwS-IXq7iu8mfwizkM5_g:Elyomi8rZZVOUoa4Connection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Wed 29 Nov 2023 14:52:59 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: same-siteContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-yoRNgGFA_jFWMEaoEpc6QQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionReport-To: {"group":"AccountsSignInUi" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Wed 29 Nov 2023 14:52:59 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxBRB-pSiV5I7gzgezv5ScogfG5pJICc89uo11Rfkx99KINYSZ_8pnh9B8SKYGTJNZF-2bw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-133805523%3A1701269579443107&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-wy_uA7ny9bIH5c5X5aaT8g' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�000000010000000100000117b�RMo�@��+��) �H6��(j"�U/��ǯ�MO:�dgg�{��[u�/�qG��^��x�xd|�\J�*�htT�h��;ư'kw��ͭO�|�]��M�[��=�Oɑ�[o��8�l�̝I8Rj�&:]e�v��{D�D1F�bg��s�K��DԀ�+C�LGg[��E_��э��e�Uq��jea �,de3��;HwZY�R��`�h)��x�g��lF7t�M��a��7L�vy��4Qtɘ��!�jϴ2��.u��F6[�v$g2�ڨ�=��M�R��m�_�G!{(Y�'��z�ʲ۵˕�;u�²e@ph��~"��V5��,��vх�c�F�q��{ ��K�r�(kή��x��Ϧ�`9>G'��L�Tl�P�#g/-�键��Iy��p�r��VK��v��;�J�c��֎,�ݚ�MzJ�j��Õ��\=c��r�J�h�j��t��G��^)+�amu�<��}�}(��T��P�V�\��=Y(��|�#��w`:g�Ke�EY�9<��ܕ(�>8PSM�z{S��؁�;��s��d��w<��_~�9�̝��c)��d�'��*��}E0O��;U��K��5d<��SO��zsQ:CAz*I�5��Z{2�}��jP*�dj��7+�$j��N��D��Q�" ��N}��F�\XS�L��k�uw�ؽ�<�O'��#�I��?�"^~�1T$[�u��4��GL��2��5��N�o�U�r��5��Q(�M�P)��T(�9�۳�.��}��w�{�r�;��#�.T��/��O]�܊0D��F�cO��0ř��l#�F�Y�[*sW*��Ht�'2�^�t��fw�/�Ol�w�u�jf�$v��=�-�4=<|"�T��g�@�un�g��{��#�Q��f�O�޾C��!�\ٵ��*_U=j��%��up�@G@��g�{��+��Ӯ�;��m�u��W�m��]�3�(��<^�_*tb�ݻm�T)�g��'�{)X��{�t^P�{�9�Ҵ{h~i�/=�#��ɼ��k�}��AY5\*��}�ڐ�oh��ɞ��;C5��p��cE�7�`�QR�d�7�,C�E�e��ߔ��ݱ��9��!*܎L��х�H$v:4�kok�<��k@I�0�`��-<�{@�P��ѵ+�p�^P �B�/��J�V�^hݪ/o�J��DP��=��'J��^�.MЖc�RE��z��d��F��m��pD�yK�]i5m�̦"n��^�L�8�~k��(��[��E��0)�6=%��d��t��d�C�0ߎ��1��1��k2�\Pr��#��J��@$�b�EH��]��70��NRߒ4��j�<��]%1-y" "`጑�Y(�?�Cy?�C�*@I�3��A��=G�"�!�:�s�&+@��Gfi�{�˘]�z��q�+}��j��qW��ig��k�[�nꃝ�z��C�$L/�@�ʈ��f�� $��݃�R]Yxw�q�p��6��ȁp�!xp��{n��j��{s��)\��N;Ѱ.�\�I��mTT��Q�4dv�ϭ�i�T[z��8e��6k��g]��Y�`oxz��o�jM��S��1�O~�)�m��g�'��NO�|��ON��3��Wg$�==�}�o?��[��|�'_�I��o�O�P|�m�$Y�n��{��a��'��Y��2:�yݙ~Żמ*πvops��)H��ϭ��N�p�.��H\PM��_�6Z�#�#��\�1C��gZ��78!U��?w�Ǒ�Aݱ/�?�huƯҬ��N1��6�Q�v,Et~k��-Z�)H-�h";o��0�oB� ��#]��EC-��G��r��ޟ_u~��yPq��mfF�eI5ζ�l��?c��}��V�hj6��vhvJ"t�|�]��B��B0�R)k-��!��?))`��+�rD��P��C�}��4��G�̞��G��ɭ�f�r!˚O0�\ �?p`b�a�H��!��4�1Ŋ)}~N!��E`�dQW�= ��&w�Z" �E��`)@d�/dv�)C�c�n�W��d?ɿ|��O"ܹ��Z��1�X�l3�NyT��{2#��ʁ�@xa}v1n*O��?�s�;:�Bn��ʒ�5�@miMo��E^��p�Ql�4dQ=�ߗ��KS��b3{|v��i�"a��@�\7��Ϝ��*G�_��q��1Z��.d/0ܯ��@`8�a8^�A��z��(��#`��&�¯,6&h/��Dy�m�f��M@e=h��/��朁b盿��8��[~]w��@��)�fZ��*]�h�T<��[$_��q�S<��u��f0��GW֩�N��k;��5��JJ�9��os��i��L��ff��2&�|�+;=o��\.PD��4��.��e�Z{�" "[��9�[��>��~��w:�-��e��?ߌ��{fT��7��si24w�./��ּd7�W��c�gH��и{�|#ZOg�6Э��$�Id@jf8��A��Bڠ3g��6��h\w��1��A��;`��?C4�-�K;�I"{`��rd3�>c?�x]�H��6�!�Ed��˱�J�-��R��7�f��mI5��P9��Ä'�{��l>��AP��ǘmFҥ�8X�+ބ�5��,�+��E��V�o��+�M��nP�br��f_1a�4��x+1�3�O�os�t�~D�^A4�`��f짣mणM��B{h�b�E� &��2��D�]N�4l�0�B0J�&�3��lW8p}�Ac��7��<�f�L�`*xϦ~Y�r7�쇹0]vl�>ަĸ�7'�1#ˤ��3\U�3t�/��R6v6�♁��Ղl��+��Q�KPE��/ò�3lD�3i�|�蒩0{bC�H1�}ޡ!",��L�^�T��1��ϮC�/0ag�r:q�z��|=��U�QO�og�G�o�K\_�T�b,��d�Y��vls�.�.7�W�0��F�fo�j�9��&�s`�2L�c��,��ĪQ��&M��G�.P��N�?��~c��H��G��|'2�y�&%o��Uih]6�*��jܦW�{��[��+Jt��(I��b-��@��8G8�h�`�^�y'��5F!�9��Y��,�\h] �40��ؤ$��P��~�E�E��~�D�1�|��g�+�L�/�]4�!��9e�b>�ƫR�KW�ɵ�K�@��J�S<��FO�*zj�َ"O��&�2 �4�X�ȑ"e�Z�s�̧�ι3�[.��&�]0��!&n*�a.��c޾�^��(ϑ�+y�p�]H�ގa$9��%��d�pw�6�X{��uU:��MC&j"t��$4)hL�b�3�͂r�VC^+^P؀�,q��Ԫ>3A�Pq�7��B��%��ҕTcޱ��Ñ��", "�`uĐ�'kl>m�A��@r�?}�D�%��z]�?==��2Y�}(�6��P`3��GE�j�Eu�w�l!q^Q�}��ӷ�n$��Q4}�bޛ��,��.R�|!�)��p&QC5Է�S�u�xY ��zk�:��ʽ�`s��fMi��r��ca6�|��>�(�L��g�V��3��,�#�C��Z��%0(��ƚ��)��]1�O��/��㪅1E��⒢��C�b&��Ɍ�y��W�M��2y��-�7��Q VfȚ�"Ij��,�G�5ߦC��1�!7�f�o3G5�f<��J��y�W�ǜ�1T1fA~EA�9��0��T�#,rKf��.6|,j�8��p��?2�{}$!:��3��V�Xn��a?xP��dr9v�|T��.�b|�,ץEM^��F��b"�VV��F��pc)K7�m��.��p�\)�)a�#�²M��=|��q��[4��h��&u��~��3�??��]��4��5�'��i�0�6Y}��CDx�Q��6�b��B*ϕg`��d%��y��%%?�)��v&�^y��3��9��&��r��at��y-�3�kL��"��H�n��Hxov�Yޘ)�n��s��}yS�A�E3�#ܛȟD�s3F��B�zyx�?sd�n�%P�x,�H��+r�O�q��!�:��qo}��_{��?��l�Ə��cwK_�Y_��q-6-��Yx�1��n 燽QgC�4��uڸ2�(ذ��,En�s�b}�j!�I~-��wJ��6W)C'��eWY��ys��&�D=֔k~˳ؕ7N2�ޒw��W�-�n��]Qe��+r%�\�(��z�)�>��X<��%~��9jHԜ5��ҭc��I4��8��'b+��>[�T,�6�(�UF`,tZmG��Czq%x�+��U�\r�-�� K''��|��7jSڄ0�6.��M�ĝ^��ts��ˡ�om�㑯��+��v�b�V<��^OS�x+��(U�c�KQG�vⷰ��J7��M}�$�H�J�tZ��E,��H�c]��ޣ9/�5�L�|�p�?�KnAc[��n��><��ط�)P��?�H^��iYix��Q�pRK0��\fm��S�3��H�_�V��j�2��W%l_geZ��D��*VU��XIH6sY��u�?�!�d*�qqn��j|7ı��!��LD�yO��2�8��Q�)]ĻW\'�es$��[�b��NӾt^��0��/�u�+��)MFFnmD��8ڈ=�\��Z%��6�9��(w&��f1G@��Rh��2�X�̷.��ؾ1��iʐc��4䈎�(�HB�n�oC�?��=�^kC�}˞S�|w�9��T\'�ʧD��gr��k��=�#��X�m^�uE��c_|x��^,�{_�Ӱ+��"��e�co[��", "��9|;��;yjc�wi�DE�4��O_<��Ƽ?�z�W�M@�s�Z�㪅R��_��__#�:��iJ!�$�l�y��\�\ч�{�8ǵ�xSc�J��Mt5�2��@�YOa�sGuiɄ�5.��/��'_ҽ$��S.��B��1Խ��>gCr�D�� ,�j��j>uo-��1��$��m/�^�k�1�_�,%o��Q�u*�j��ӣp�WG�<8�3:��JmcA+�K��g:�ٕX�hf;�1D�.�>W��/T�� y��{��u�/�#\��+�G��E� W��%��M)��N��W_Y��q�-�$��Ԃ%��eOp��`O��+#�e/D/1��/='Ͼ��/��", "00000001�0000000100000001k00000001o00000001�00000001600000001�00acf��K��2�N\%ƀ�ˊ�k��E?8��8�#��4i��"%�'>��l��v ��>�)P��UftH�9J��v��+�\�9�c]�UJ}%��k@n��(�2"Ts�0�j�#-��9)�'�_��/`qβ��V)X��hnK��'$�yܥ��R��#�\��=t�޲��{oY^��K^p�|q�K;^�̑YG�NG6��>�u��OB"bݐ��^��0�ku��I΢�fם�J�0m3Y�S*��!��*�b�ꯃ*�Y�*5�r�Q�}�N ��b"IߪJm��ߞ�", "�Ŝ��&��8��Zz�&��ٌ[#ͯ��\��a��:>�臡�ޛ��#��j��ԝ�ſ?+��Z��^E�[c��JmOԗ�kza.?�;��0�q�rzy��1�eP�k��)��a�̸��M�wU��O�J/f!f�rF��Ƃ%&�Be��q;��)R��(r�U>��O��I2��Y6��,V��"Z�4��(Ъ�d^�|�fu�-�Q�Wdz�ݤ{��7ųkew��Tev��0U��:��`A.\�/�a��O�Vq�>��٦x��ɴw^9�^�Ju@�=��1Dd�Z�,rjq��"|LV��Sr�/a�R��3� �VAi�xd�cI��+��M��ӡ��FP�l=�zh��n��ˊ�`8Xh2d��=t�w�Q�>�@�,�8PeO��_i��U�0/��5-�UW��Tn�k��f�.Ĳ�3�Y��b�~c�PE�L�N��v�\�H�]t��?,��2N�:�{Ϣn�dQY�+�qj*��(:+��&t��#�W�$��>��h��c"��B�X�hV�5[�$`m��b>��`�Pؗ1-�s�|NZF�E��[�]ș[w]��N��0��!�W��4J!A��}&�*��dh��j1�i��u��X��a|ObZ��/V��v��0��kjOi��KѠM��}�{�P�v��'�܏�`�Y��_�tXē)h�G�O�쎌�;K�^�� xe߳��A��8�y��w��SmZ�3[��ŋd��&�Kr��`��@��(�p^j]��7=�Ѡ�B+?n+��}E�x��n��&qek��٪�֏�j�R�E�T��&�}I��)n[j�521~��|��i��0V��/�Q_�\Nd:�", "hZ��ԿO�Gq�̯W�d�q]3�T�!ş��τ� :��J #��oo��=^+�sAÝ�`��!�%�-�詌�H�օXz��F�/��", "00000001�00000001]00000001Y00000001�00000001�0000000160000000100000001�00000001+00001�cb8ڗU��")i$��>��8>��xk�[y��M��sW��"W��hykS�dD��F��@7XB�o~��]�>��!JU�5li��/��h��/-��ǹ��A?��oZF�/g�=�hn�RP��0�:��X��tuN��V)*X��X�y�!5��XHM��U��*�4]،�:]4p��Ny�^v }&�V�4kA*K59R�*(��[��0�qO�s��ؐRʷ��'��yf��#��P��X�w�C��ֲQ!�G�6 ��Rj�%S8�z@C��ں��T75�q�L�U�Ue3��8�_�r�3ꓛ��>�4 ��%�8<��:_m��5��v@�l�Vz�V8?�ed�p6-ڎ�is8ϰ��cl�l��5��MLg��zq$nb<��D+��*�lK�y��"�R�ݎ�Fאw�j^��}C��M<(��`uGA�3��(��kV�B��<0Z�K:�N��c��Q��TcI�Wg��Y*��ٓ��W�/Id��ѥXa�+®�?*��Ǻ�g�l�ޯ��Q��J73�/��FŢC6E��K:3�^��E�;I)NP�6~w9��.5��b�^C (�H1��j�!�;l�I��,�A��k||��O�'��X�s�K��q��$-��[]�K�k*�k;q�EAr?�/=e.7��`��n��f��6#�E��,��]#�"��$[��$�ǷhJ��8ǐ��l��J5�Gc�ϟ�O��9vpZ�R�nS�J��Evga��v"�,δ��{*IF"��iX#�Ul�oL]`��Ga�'I��Z��JW9嫬|�S��61�ǧ�ZJ}:[��ݫ�S9�![�U�Nq�W��j�^k"Z=�/�Yk��,J��N��՞�ȱO�W:��S&�3}��P��Mب}�SC��C�a��^+��g@��j��M�5�T�J��ƃ�>%x��*�3�P`&�.q��h��r:��^N�P;�[�SnCr��)��"��#��\è��[��&��-�C�$��sm�Q�?!��S��[=5d��⧇=c��?A;�rSd5K�a��W��ʳ�yڕ$xrnyFVu��9�Ђ��<8d�q�2��"S��U��ʫ�M��2�(Nf׆AV��j|�'Cí��.��5�uy��a8��c��ǳ�׊��F��U��Ok��J��F+��ʖ�%�4�7@��;p[�k�!צ��`u�?l��al�L�ܓQ��ﳃ��mN��k} �kR�G��R��74R�uq;�®��}^��Lh�<��t�FZՅ^\N�wۑ-�뇺[b�vz�_��V��>B��GT�=�h>V]0��yH��9��,��괒��9�@�Hh�mw��E�c��N��^s�?��z�D��h�@��?��q�v&�a�o(�*o�!~��DC��:�٦�ޥ�4/~O�R�L��m��%1k�P0�O��/>�:��Wg��U��>/��YeB��oW�մ��?�Y�GGI��|ZTz�w�S/ᒖ�z�~[>�I�i�K�f2��??�9��5��o��9�'S3h7��@L|w�:��*_��d��=��VIT|w-�B��MO��-B�'�T�a��MHk�і:�x��$�$�F?��;�n�k�Bi��9�E��h�/j��+yC�e�R��$�t�n`[�v��J��R&\��7?��s��>��Z5�d�a��f�XkB&�Ef�J��M��d�V)��z�I��n��l�; ^д�O��[��5��~D`ͳ$KWQ��)��HQ&qN�h��p?!��T�+�я��&�?��Xu��}~Qe(��G��!IŐ�~��wF?_�#̤��ƧP�W�A32��5[��f��*�{��_N'��1�zi��#�'�%�Q�CF��VyڞT�:ԟ��NX��D��R��*��h��Ir�^��b��#�&��cqK|S��j]�AYSf��&�'=��Xb�?_OӏK��^�굘�o~8��;��Y/J��`�f�1��ǧ��JXsjyu�4A�P��ݿ?�Q�{��J^RV�p�R.��%c��O#��Z}��F��[)�o��?*g��$��f�н��)L˫��oı(*^wP�׀�pM�P��5�b4�&zg��t@q�3�LÕ7+�;��v��B��p'm��]�k��ص��|��.a1�$r��^�cj��1;�E��[��=��", "�~�ᠢj��Q0fe��S��oG�aۧ:��Ař�O�޼��.�p��W΂@8��JfWwk��c8�p��pvy7�\��z��yA�!9b�5��΀3{�+�K��b0��>��`�_��N�T�k;��Zd�:Ae��0�~�9��!��q��[�in�xE2u;��!7��R>r��S8��#�a6o��O�� '!ӹ��W!S��h�]B8'͍/��R�{j��<�C"�n��g��ӿƛ`}�2,�'��YV�[�l�Ҳ*4L�B�Kq;-�m��ĭи�V��q#t��-��n�r�n��Mc3T�-o�=�6-CJ�3�0)BM)-"MAj�Z�bY��(M� ��4Ŗ�c�� կj�)��)H��w|ͧ)��@�)H�]KS,�cU�)��ңr8�{��Ć4r��D�EsB��߄MS:ŕ.�R ��4��a�L��)��)��E�瞧8�~�Ps O��#�%��_G}�� R��T%gcY!��2��"&Y9#!n��"�-)@��+�I@J��^9Ȍ�%E�<�8�^<�{J;b|ܴωB��`��`Z��5.�S�s�iL��<-��\��EP�Uc�,ʐ�{=��j@�)�X�|q>��Y��N�dȜ]��}X3Gd5�4�=��a�n5K}IM �ɦ@E�3��;S਩ÚG��Q��N8�L�e뾹ّ-�O0U�6�O2��uÓm%�4�^Gc@��[�}�(�t'�}��|�_��W'��$߽X�:�ρ��ti��I��Iq�I��0.@<��J��D�s.lE�a<%�¼��1�`��"�7N�6�[13Hg)�W��", "�o>�Uk�/�7�o��!߄D��D��OA8�a��g��>�.�L��lہ�VG'\-��7>�T;�P��o��Уe��"W!I+�_�ޜ��+�|MF?��JJN�<�)�N�m��B*��v+�'�׶�^N��(e�t��w��!m>F2t��!rIN�ڌ�4I�gw�_��*��pi;�o�@�e�Ӣ��a��fZ kR��I_CM"E'��d0�O��Pp��"��:��,'Qϝ3V��89pI�