24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 8c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 63a2ca4d70cc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 63a2ca4d70cc…. Malware family: Trojan.Generic. Threat score 100/100. 5/25 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/63a2ca4d70cc4601a03ca16d80b6f965fb9aebb62a0a9915f66b3e32ad625e85","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","63a2ca4d70cc4601a03ca16d80b6f965fb9aebb62a0a9915f66b3e32ad625e85"],"about":{"@type":"SoftwareApplication","name":"88f06c42b6a5abb4bca8d456bbdb0b0d.exe","applicationCategory":["peexe","executable"],"identifier":"63a2ca4d70cc4601a03ca16d80b6f965fb9aebb62a0a9915f66b3e32ad625e85","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T41b,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindResourceA" with parameter "784744" - (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindResourceA" with parameter "3740360" - (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindResourceA" with parameter "3740368" - (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindResourceA" with parameter "3740396" - (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindResourceA" with parameter "3740408" - (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindResourceA" with parameter "3740424" - (UID: 00000000-00003856) "gG7nW35.exe" called "FindResourceA" with parameter "10359496" - (UID: 00000000-00003268) "gG7nW35.exe" called "FindResourceA" with parameter "10359504" - (UID: 00000000-00003268) "gG7nW35.exe" called "FindResourceA" with parameter "10359544" - (UID: 00000000-00003268) "gG7nW35.exe" called "FindResourceA" with parameter "10359560" - (UID: 00000000-00003268)26:Ta2a,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3786832'}" (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3786864'}" (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3786848'}" (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3786816'}" (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3786768'}" (UID: 00000000-00003856) "gG7nW35.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10405968'}" (UID: 00000000-00003268) "gG7nW35.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10406000'}" (UID: 00000000-00003268) "gG7nW35.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10405952'}" (UID: 00000000-00003268) "gG7nW35.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10405904'}" (UID: 00000000-00003268) "gG7nW35.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10405984'}" (UID: 00000000-00003268) "TI4ji42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881680'}" (UID: 00000000-00002584) "TI4ji42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881712'}" (UID: 00000000-00002584) "TI4ji42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881696'}" (UID: 00000000-00002584) "TI4ji42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881664'}" (UID: 00000000-00002584) "TI4ji42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9881616'}" (UID: 00000000-00002584) "xu3MF69.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18729040'}" (UID: 00000000-00003676) "xu3MF69.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18729072'}" (UID: 00000000-00003676) "xu3MF69.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18729056'}" (UID: 00000000-00003676) "xu3MF69.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18728976'}" (UID: 00000000-00003676) "xu3MF69.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18729024'}" (UID: 00000000-00003676) "6nW2ca8.exe" called "LoadResource with parameter {'hModule': '1898643456', 'hResInfo': '1898820104'}" (UID: 00000000-00001716)27:Tc0b,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00003856) "gG7nW35.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00003268) "TI4ji42.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00002584) "xu3MF69.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00003676) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Cookies (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Autofill (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\FTP\FileZilla (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\FTP\TotalCommander (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\FTP (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Growtopia (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Minecraft (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\TLauncher (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\FeatherClient (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\LunarClient (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Battle.net (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Steam (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\Skype (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\Element (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\ICQ (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\Signal (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\Tox (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\Pidgin (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers (UID: 00000000-00003440) "AppLaunch.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\VPN\OpenVPN Connect (UID: 00000000-00003440)28:T44c,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "5ok1AV0.exe.2503033822") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp")29:T462,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp")2a:T885,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "5ok1AV0.exe.2503033822") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")2b:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp")2c:T5d4,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "GxGC52INhg0_1_.js") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "GxGC52INhg0_1_.js") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "qvzskUrYlYC_1_.js") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")2d:T2754,Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"2e:T504,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Imports Crypto related APIs Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2f:T33fb,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003856) "gG7nW35.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003268) "TI4ji42.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002584) "xu3MF69.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003676) "1eb74op8.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002528) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000045089254432a2c6968ff1a0048cd1b00e8d21b0050592c6921d4a73dfeffffff14cd1b004b652b69c0cc1b004ce9fd7331c52a6964652b69 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009998a15488ca1b0080cf1b00d29ffe71000000009a9bfc71b001ff71eca3fc713998a15402000000b001ff7100001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001005ff710000000060d21b0055a0fe71 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000089f4bb76cdf589540200000040d21b003cd21b000200000018000000ee292877980181014875370090d11b00c83ac57604d21b00d58cbd7640d21b00d4d11b0042a4bb76a802c57614d21b00d2f4bb76080000006ef5bb7644f5bb7615f68954020000003c41fd7100001c005e43fd71e8d11b000200000000001c003c41fd7118d21b0042a4bb76a802c5765cd21b00503efd7108000000273efd71e985a154020000003c41fd7100001c005e43fd71807537004875370028d21b0000000000e8d21b004437fe719d694725feffffff273efd71a53dfd715e43fd717cd21b00 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001b00000000002ac61b000500000081d0a275e0c51b00e4c51b0000000000e85622009c502777e26b18755001000050010000b0c51b00b0ea3c7750010000d0c51b008cca1b005ecba0755001000000000000005d9e75e8cc1b000e5d9e7580c81b00dcaaa275010000000000000072000000ffffffffffffffff08c61b0078020000000000002500000008c61b007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360049e3895460c61b006d821e77f45b230004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c004100700070004c00610075006e00630068002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b28775aff2477d8eb7e75ac011c0000001c0024004800170000000000ffff3a060000000000000000000025004300170000000000ffff3a0600000000000000000000186f1c0000000000200000000000000000000000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001e770100000000800000000000000000000014be1b0023331e7748be1b00008000000080000048be1b0037331e77000000004ebe1b001d9b895430be1b0067321e7728c31b00039b895454c01b00135f9e7548be1b003ac31b000000000090c71b00386e1e005cc51b00205f9e7543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600a59b8954ccbe1b006d821e77c4f0240004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e19d895408b91b006d821e7774f7240004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e77b4fe250004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e77d400260004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600f83b0000ff07000000001c00000000007f070000c4001c00e82e1c00fc22000054b21b0067e5257700001c00000826000000000000001c00000000000008260000000000a822008a80000000a80a2600c4001c00b0752500003b000000001c0000000000000826004016000000001c00f8042600f83b0000ff07000000001c00000000007f070000c4001c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e777c02260004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600f83b0000ff07000000001c00000000007f070000c4001c00e82e1c00c722000054b21b0067e5257700001c00a80926000000000000001c0000000000a8092600000000007322005180000000500c2600c4001c0098282500003b000000001c0000000000a80926004016000000001c00a0062600f83b0000ff07000000001c00000000007f070000c4001c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e77ac03260004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600f83b0000ff07000000001c00000000007f070000c4001c00e82e1c00a122000054b21b0067e5257700001c00d80a26000000000000001c0000000000d80a2600000000004d22006f80000000800d2600c4001c0098282500003b000000001c0000000000d80a26004016000000001c00d0072600f83b0000ff07000000001c00000000007f070000c4001c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e77dc04260004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600f83b0000ff07000000001c00000000007f070000c4001c00e82e1c007b22000054b21b0067e5257700001c00080c26000000000000001c0000000000080c2600000000002722000580000000b00e2600c4001c0098282500003b000000001c0000000000080c26004016000000001c0000092600f83b0000ff07000000001c00000000007f070000c4001c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e770406260004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600f83b0000ff07000000001c00000000007f070000c4001c00e82e1c005622000054b21b0067e5257700001c00300d26000000000000001c0000000000300d2600000000000222002080000000d80f2600c4001c0098282500003b000000001c0000000000300d26004016000000001c00280a2600f83b0000ff07000000001c00000000007f070000c4001c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e773407260004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600f83b0000ff07000000001c00000000007f070000c4001c00e82e1c003022000054b21b0067e5257700001c00600e26000000000000001c0000000000600e260000000000dc2100fd8000000008112600c4001c0098282500003b000000001c0000000000600e26004016000000001c00580b2600f83b0000ff07000000001c00000000007f070000c4001c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e776408260004010000 (UID: 00000000-00003440) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600f83b0000ff07000000001c00000000007f070000c4001c00e82e1c000a22000054b21b0067e5257700001c00900f26000000000000001c0000000000900f260000000000b62100978000000038122600c4001c0098282500003b000000001c0000000000900f26004016000000001c00880c2600f83b0000ff07000000001c00000000007f070000c4001c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600cd978954e4b21b006d821e778c09260004010000 (UID: 00000000-00003440)30:T8d1,"AppLaunch.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7e7500f621000060fd7f9a5c297700f0fd7f40d21b004460fd7f00000000400000003f000000210000000060fd7f34d21b00c15c297760823077210000000060fd7f9a5c297700f0fd7f58d21b00578928778083307713171975d8eb7e75 (UID: 00000000-00003440) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000200000000000000880000000000000068d21b00459dbb760000370000000000800000000200000000001c009c1d1b737cd21b006c221b7380000000d3221b73dcf01b7398d21b00741d1b73dcf01b7300000000c8d31b0000000000 (UID: 00000000-00003440) "AppLaunch.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7e75b0d422000060fd7f9a5c297700f0fd7fc8b11b004460fd7f00000000400000003f000000270000000060fd7fbcb11b00c15c297760823077270000000060fd7f9a5c297700f0fd7fe0b11b00578928778083307713171975d8eb7e75 (UID: 00000000-00003440) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000070721c00d80100009cc70f03186f1c00e4ca0f0395e1247742521700feffffffff2b28779a2a28773800000040000000ecc80f03086c1c00ccc70f03a0942b00e4ca0f0395e12477425217000300000000000000200200001800000074c80f03575f530000001c000000000018020000 (UID: 00000000-00003440) "4oC416uQ.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000068722500d801000014cc8102106f250064cf810295e124774a701700feffffffff2b28779a2a2877380000004000000064cd8102006c250044cc81028034df0264cf810295e124774a70170003000000000000002002000018000000eccc8102575f4801000025000000000018020000 (UID: 00000000-00003352) "6nW2ca8.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001716)31:T566,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")32:Tb19,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00001156.00000000.69187.00B61000.00000020.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00001156.00000000.69187.00B61000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "5ok1AV0.exe.2503033822") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "5ok1AV0.exe.2503033822") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")33:T7e2,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "gG7nW35.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "gG7nW35.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "TI4ji42.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "TI4ji42.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "xu3MF69.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "xu3MF69.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1eb74op8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1eb74op8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3OR33jN.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4oC416uQ.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5ok1AV0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5ok1AV0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")34:T4cc,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")35:T566,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")36:T74c,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\APPLAUNCH.EXE") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\APPLAUNCH.EXE") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")37:T9ea,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")38:T59a,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")39:T8bf,"AppLaunch.exe" called "CopyFileA" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00003440) "AppLaunch.exe" called "CopyFileA" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00003440) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\signons.sqlite to new location %TEMP%\posterBoxC8Q0hG4pT4Rhr\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00003440) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\places.sqlite to new location %TEMP%\posterBoxC8Q0hG4pT4Rhr\8ghN89CsjOW1places.sqlite (UID: 00000000-00003440) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\cookies.sqlite to new location %TEMP%\posterBoxC8Q0hG4pT4Rhr\D87fZN3R3jFecookies.sqlite (UID: 00000000-00003440) "AppLaunch.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\places.sqlite to new location %TEMP%\posterBoxC8Q0hG4pT4Rhr\02zdBXl47cvzplaces.sqlite (UID: 00000000-00003440) "AppLaunch.exe" called "CopyFileA" to copy %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00003440) "4oC416uQ.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\signons.sqlite to new location %TEMP%\posterBoxZ9p4VRlZaB0a6\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00003352) "4oC416uQ.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\places.sqlite to new location %TEMP%\posterBoxZ9p4VRlZaB0a6\8ghN89CsjOW1places.sqlite (UID: 00000000-00003352) "4oC416uQ.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\cookies.sqlite to new location %TEMP%\posterBoxZ9p4VRlZaB0a6\D87fZN3R3jFecookies.sqlite (UID: 00000000-00003352) "4oC416uQ.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\places.sqlite to new location %TEMP%\posterBoxZ9p4VRlZaB0a6\02zdBXl47cvzplaces.sqlite (UID: 00000000-00003352)3a:Tc14,"AppLaunch.exe" called "CreateDirectoryW" with parameter %WINDIR%\System32\GroupPolicy\Machine (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryW" with parameter %WINDIR%\System32\GroupPolicy\User (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\FANBooster131 (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Cookies (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Autofill (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Downloads (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\FTP (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\FTP\FileZilla (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\FTP\TotalCommander (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Growtopia (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Minecraft (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\TLauncher (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\FeatherClient (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\LunarClient (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Battle.net (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Steam (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\Skype (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\Element (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\ICQ (UID: 00000000-00003440) "AppLaunch.exe" called "CreateDirectoryA" with parameter %TEMP%\grandUIAC8Q0hG4pT4Rhr\Messengers\Signal (UID: 00000000-00003440)3b:T59b,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\gG7nW35.exe" - (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\6nW2ca8.exe" - (UID: 00000000-00003856) "gG7nW35.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5ok1AV0.exe" - (UID: 00000000-00003268) "gG7nW35.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\TI4ji42.exe" - (UID: 00000000-00003268) "TI4ji42.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\xu3MF69.exe" - (UID: 00000000-00002584) "TI4ji42.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4oC416uQ.exe" - (UID: 00000000-00002584) "xu3MF69.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1eb74op8.exe" - (UID: 00000000-00003676) "xu3MF69.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3OR33jN.exe" - (UID: 00000000-00003676) "AppLaunch.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" - (UID: 00000000-00003440) "AppLaunch.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" - (UID: 00000000-00003440)3c:T2e0f,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003856) "gG7nW35.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003268) "TI4ji42.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002584) "xu3MF69.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003676) "xu3MF69.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003676) "xu3MF69.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003676) "xu3MF69.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003676) "xu3MF69.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003676) "1eb74op8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002528) "1eb74op8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002528) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003440) "AppLaunch.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00003440) "3OR33jN.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003364) "3OR33jN.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003364) "3OR33jN.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003364) "3OR33jN.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003364) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002860) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002860) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002860) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00003520) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003520) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003520) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003520) "4oC416uQ.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003352) "4oC416uQ.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003352) "5ok1AV0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001156) "5ok1AV0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001156) "5ok1AV0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001156) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002340) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002340) "6nW2ca8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\6nW2ca8.exe (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00001716) "6nW2ca8.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00001716)3d:T136e5,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003856) "gG7nW35.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003268) "gG7nW35.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003268) "gG7nW35.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003268) "gG7nW35.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003268) "TI4ji42.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002584) "TI4ji42.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002584) "TI4ji42.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002584) "TI4ji42.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002584) "xu3MF69.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003676) "xu3MF69.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003676) "1eb74op8.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002528) "1eb74op8.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002528) "1eb74op8.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002528) "1eb74op8.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002528) "1eb74op8.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002528) "1eb74op8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002528) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSChannelInterface (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultFree (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultCloseVault (UID: 00000000-00003440) "AppLaunch.exe" called "GetProcAddress" with a parameter VaultGetItem (UID: 00000000-00003440) "3OR33jN.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003364) "3OR33jN.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003364) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002860) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002860) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002860) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002860) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002860) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002860) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003520) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003520) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003520) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003520) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003520) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003520) "4oC416uQ.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetSChannelInterface (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter VaultFree (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter VaultCloseVault (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter VaultGetItem (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003352) "4oC416uQ.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003352) "5ok1AV0.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001156) "5ok1AV0.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001156) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002340) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002340) "6nW2ca8.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001716) "6nW2ca8.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001716)3e:T18c2,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00001716.00000001.70425.02C80000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?") "CREATE TABLE sqlite_master(" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "create table sqlite_master(") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "CREATE TABLE" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "create table"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")3f:T1207,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00003676.00000E5C.524527.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00001156.00000000.69179.00160000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001156.00000000.69179.00160000.00000004.mdmp, 00000000-00001156.00000000.69179.00170000.00000004.mdmp, 00000000-00001156.00000000.69179.00420000.00000004.mdmp, 00000000-00001156.00000000.69179.00D20000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001716.00000000.69562.00090000.00000004.mdmp, 00000000-00001716.00000000.69562.004D0000.00000004.mdmp, 00000000-00001716.00000000.69562.00C10000.00000004.mdmp, 00000000-00001716.00000000.69562.012B0000.00000004.mdmp, 00000000-00001716.00000001.70425.00090000.00000004.mdmp, 00000000-00001716.00000001.70425.004D0000.00000004.mdmp, 00000000-00001716.00000001.70425.00C10000.00000004.mdmp, 00000000-00001716.00000001.70425.012B0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp, 00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp, 00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMv" (Indicator: "CreateProcess"; Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp, 00000000-00002528.00000000.66162.001E0000.00000004.mdmp, 00000000-00002528.00000000.66162.00350000.00000004.mdmp, 00000000-00002528.00000000.66162.00490000.00000004.mdmp, 00000000-00002528.00000001.66342.00070000.00000004.mdmp, 00000000-00002528.00000001.66342.001E0000.00000004.mdmp, 00000000-00002528.00000001.66342.00350000.00000004.mdmp, 00000000-00002528.00000001.66342.00490000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp, 00000000-00002528.00000001.66342.00070000.00000004.mdmp") Found reference to API "CreateProcess WRPMitigationLays" (Indicator: "CreateProcess"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp, 00000000-00002528.00000001.66342.00070000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002528.00000000.66162.00350000.00000004.mdmp, 00000000-00002528.00000001.66342.00350000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002528.00000001.66342.00070000.00000004.mdmp") Found reference to API "teCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002528.00000001.66342.00070000.00000004.mdmp")40:T51b,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "15187790579,3300,3135,,LoadResource,kernel32.dll,"252:03:54.171",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp")41:T4bb,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")42:T42d,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")43:T4da,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")44:T59b,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe "System\CurrentControlSet\Control\Session Manager" in Source: 25517-17-0040256D "%APPDATA%\Opera Software\*" in Source: 00000000-00003352-00000C27-12998461800 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00003352-00000C27-13417871341 "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00001716.00000001.70425.004D0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001716.00000001.70425.004D0000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002528.00000001.66342.00070000.00000004.mdmp45:T8d0,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "xu3MF69.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "xu3MF69.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1eb74op8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "3OR33jN.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "3OR33jN.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4oC416uQ.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4oC416uQ.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5ok1AV0.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "5ok1AV0.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6nW2ca8.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "6nW2ca8.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6nW2ca8.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "6nW2ca8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "6nW2ca8.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135]46:T4fc,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "gG7nW35.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1eb74op8.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "TI4ji42.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "xu3MF69.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5ok1AV0.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "FANBooster131.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT47:T550,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "26HUODCY.txt") Found string "0xUKUvavQqUreOv9Z..Blc1jq.j9.AAA.0.0.Blc1jq.AWUZ3OFD8gIfacebook.com/92173642855680310929202166112030310748206lhzZXJ4UFFJl9i8yVlRtx11facebook.com/921789234252831155282217017453031074820" (Indicator: "facebook.com"; File: "QGST3TEC.txt") Found string "0xUKUvavQqUreOv9Z..Blc1jq.j9.AAA.0.0.Blc1jq.AWUZ3OFD8gIfacebook.com/9217364285568031092920216611203031074820" (Indicator: "facebook.com"; File: "XAENY4SZ.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "T7F0TFXC.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")48:T1c25,"GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Fri 08 Dec 2023 17:55:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Fri 08 Dec 2023 17:56:04 GMT Server: cloudflare CF-RAY: 8326e1acbf2567fb-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Fri 08 Dec 2023 17:55:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Fri 08 Dec 2023 17:56:06 GMT Server: cloudflare CF-RAY: 8326e1b37bfdfada-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 17:18:09 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2323 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 17:17:18 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2376 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 17:53:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 236 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 16:58:23 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3519 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 16:58:23 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3523 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 17:00:09 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3426 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 17:51:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 341 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 17:51:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 344 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 08 Dec 2023 17:00:09 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3431 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......49:T2fdf,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68f80000 "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 736c0000 "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" loaded module "KERNEL32" at base 77380000 "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69250000 "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "gG7nW35.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "gG7nW35.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68f50000 "TI4ji42.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68f20000 "TI4ji42.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "xu3MF69.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 736c0000 "xu3MF69.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "xu3MF69.exe" loaded module "KERNEL32" at base 77380000 "xu3MF69.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "xu3MF69.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68f50000 "xu3MF69.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "1eb74op8.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "1eb74op8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b90000 "1eb74op8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "1eb74op8.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75980000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76af0000 "AppLaunch.exe" loaded module "PROPSYS.DLL" at base 73df0000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 765d0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 73fb0000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 76fd0000 "AppLaunch.exe" loaded module "LINKINFO.DLL" at base 6eb90000 "AppLaunch.exe" loaded module "USER32.DLL" at base 77070000 "AppLaunch.exe" loaded module "CSCAPI.DLL" at base 70410000 "AppLaunch.exe" loaded module "SLC.DLL" at base 73160000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 70750000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 76830000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b90000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74b00000 "AppLaunch.exe" loaded module "CLBCATQ.DLL" at base 77140000 "AppLaunch.exe" loaded module "DNSAPI.DLL" at base 749c0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73030000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74940000 "AppLaunch.exe" loaded module "SECUR32.DLL" at base 74e60000 "AppLaunch.exe" loaded module "NCRYPT.DLL" at base 74c70000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74810000 "AppLaunch.exe" loaded module "USERENV.DLL" at base 752f0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77460000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\GPEDIT.DLL" at base 695c0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 76730000 "AppLaunch.exe" loaded module "GPAPI.DLL" at base 74710000 "AppLaunch.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77460000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 77380000 "AppLaunch.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77460000 "AppLaunch.exe" loaded module "SETUPAPI.DLL" at base 76940000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74b40000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73df0000 "AppLaunch.exe" loaded module "NTMARTA.DLL" at base 74650000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748d0000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75980000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75140000 "AppLaunch.exe" loaded module "APPHELP.DLL" at base 74fe0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6ebf0000 "AppLaunch.exe" loaded module "NTSHRUI.DLL" at base 72aa0000 "AppLaunch.exe" loaded module "SRVCLI.DLL" at base 74d50000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 771d0000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 74fc0000 "AppLaunch.exe" loaded module "WININET.DLL" at base 75500000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 745a0000 "AppLaunch.exe" loaded module "CREDSSP.DLL" at base 74800000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74af0000 "AppLaunch.exe" loaded module "IPHLPAPI.DLL" at base 74690000 "AppLaunch.exe" loaded module "RASADHLP.DLL" at base 71910000 "AppLaunch.exe" loaded module "CRYPT32.DLL" at base 75310000 "AppLaunch.exe" loaded module "VAULTCLI.DLL" at base 6e910000 "3OR33jN.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 736c0000 "3OR33jN.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "3OR33jN.exe" loaded module "KERNEL32" at base 77380000 "3OR33jN.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "3OR33jN.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69250000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b90000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 76730000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77460000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76af0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 77140000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73250000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74fc0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 738e0000 "schtasks.exe" loaded module "VERSION.DLL" at base 746b0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 77380000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "4oC416uQ.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 736c0000 "4oC416uQ.exe" loaded module "RPCRT4.DLL" at base 76730000 "4oC416uQ.exe" loaded module "KERNEL32.DLL" at base 77380000 "4oC416uQ.exe" loaded module "OLEAUT32.DLL" at base 76fd0000 "4oC416uQ.exe" loaded module "OLE32.DLL" at base 765d0000 "4oC416uQ.exe" loaded module "ADVAPI32.DLL" at base 76af0000 "4oC416uQ.exe" loaded module "WINHTTP.DLL" at base 70750000 "4oC416uQ.exe" loaded module "WININET.DLL" at base 75500000 "4oC416uQ.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "4oC416uQ.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74b00000 "4oC416uQ.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 745a0000 "4oC416uQ.exe" loaded module "CRYPTSP.DLL" at base 74b40000 "4oC416uQ.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74af0000 "4oC416uQ.exe" loaded module "DNSAPI.DLL" at base 749c0000 "4oC416uQ.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74940000 "4oC416uQ.exe" loaded module "CRYPT32.DLL" at base 75310000 "4oC416uQ.exe" loaded module "SECUR32.DLL" at base 74e60000 "4oC416uQ.exe" loaded module "NCRYPT.DLL" at base 74c70000 "4oC416uQ.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74810000 "4oC416uQ.exe" loaded module "USER32.DLL" at base 77070000 "4oC416uQ.exe" loaded module "USERENV.DLL" at base 752f0000 "4oC416uQ.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77460000 "4oC416uQ.exe" loaded module "GPAPI.DLL" at base 74710000 "4oC416uQ.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77460000 "4oC416uQ.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77460000 "4oC416uQ.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748d0000 "4oC416uQ.exe" loaded module "WS2_32.DLL" at base 76830000 "4oC416uQ.exe" loaded module "VAULTCLI.DLL" at base 6e910000 "4oC416uQ.exe" loaded module "SSPICLI.DLL" at base 74fc0000 "4oC416uQ.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "4oC416uQ.exe" loaded module "KERNEL32" at base 77380000 "4oC416uQ.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4oC416uQ.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69250000 "4oC416uQ.exe" loaded module "SHLWAPI.DLL" at base 771d0000 "4oC416uQ.exe" loaded module "CREDSSP.DLL" at base 74800000 "4oC416uQ.exe" loaded module "IPHLPAPI.DLL" at base 74690000 "4oC416uQ.exe" loaded module "RASADHLP.DLL" at base 71910000 "4oC416uQ.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73030000 "4oC416uQ.exe" loaded module "PROFAPI.DLL" at base 75140000 "5ok1AV0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b90000 "5ok1AV0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "5ok1AV0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "5ok1AV0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "5ok1AV0.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 736c0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 77380000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69250000 "6nW2ca8.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 736c0000 "6nW2ca8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "6nW2ca8.exe" loaded module "KERNEL32" at base 77380000 "6nW2ca8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "6nW2ca8.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69250000 "6nW2ca8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b90000 "6nW2ca8.exe" loaded module "KERNEL32.DLL" at base 77380000 "6nW2ca8.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 0 "6nW2ca8.exe" loaded module "DWMAPI.DLL" at base 73d20000 "6nW2ca8.exe" loaded module "OLE32.DLL" at base 765d0000 "6nW2ca8.exe" loaded module "ADVAPI32.DLL" at base 76af0000 "6nW2ca8.exe" loaded module "PROPSYS.DLL" at base 73df0000 "6nW2ca8.exe" loaded module "COMCTL32.DLL" at base 73fb0000 "6nW2ca8.exe" loaded module "OLEAUT32.DLL" at base 76fd0000 "6nW2ca8.exe" loaded module "APPHELP.DLL" at base 74fe0000 "6nW2ca8.exe" loaded module "CLBCATQ.DLL" at base 77140000 "6nW2ca8.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6cbb0000 "6nW2ca8.exe" loaded module "URLMON.DLL" at base 75800000 "6nW2ca8.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 696b0000 "6nW2ca8.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73df0000 "6nW2ca8.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 696c0000 "6nW2ca8.exe" loaded module "IERTUTIL.DLL" at base 76d90000 "6nW2ca8.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75200000 "6nW2ca8.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75980000 "6nW2ca8.exe" loaded module "USER32.DLL" at base 77070000 "6nW2ca8.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "6nW2ca8.exe" loaded module "UXTHEME.DLL" at base 73b90000 "6nW2ca8.exe" loaded module "IMM32.DLL" at base 75950000 "6nW2ca8.exe" loaded module "COMCTL32" at base 73fb0000 "6nW2ca8.exe" loaded module "SHELL32.DLL" at base 75980000 "6nW2ca8.exe" loaded module "SETUPAPI.DLL" at base 76940000 "6nW2ca8.exe" loaded module "RPCRT4.DLL" at base 76730000 "6nW2ca8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "6nW2ca8.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 04a:Tf3f,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" was detected as "Microsoft Cabinet" and name: "sfx" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" was detected as "Microsoft Linker" and name: "Linker" "gG7nW35.exe" was detected as "Microsoft Cabinet" and name: "sfx" "gG7nW35.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "gG7nW35.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "gG7nW35.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "gG7nW35.exe" was detected as "Microsoft Linker" and name: "Linker" "1eb74op8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1eb74op8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1eb74op8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1eb74op8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1eb74op8.exe" was detected as "Microsoft Linker" and name: "Linker" "TI4ji42.exe" was detected as "Microsoft Cabinet" and name: "sfx" "TI4ji42.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "TI4ji42.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "TI4ji42.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "TI4ji42.exe" was detected as "Microsoft Linker" and name: "Linker" "4oC416uQ.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4oC416uQ.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4oC416uQ.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4oC416uQ.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4oC416uQ.exe" was detected as "Microsoft Linker" and name: "Linker" "xu3MF69.exe" was detected as "Microsoft Cabinet" and name: "sfx" "xu3MF69.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "xu3MF69.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "xu3MF69.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "xu3MF69.exe" was detected as "Microsoft Linker" and name: "Linker" "6nW2ca8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6nW2ca8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6nW2ca8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6nW2ca8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6nW2ca8.exe" was detected as "Microsoft Linker" and name: "Linker" "5ok1AV0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5ok1AV0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5ok1AV0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5ok1AV0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5ok1AV0.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "3OR33jN.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3OR33jN.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3OR33jN.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3OR33jN.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3OR33jN.exe" was detected as "Microsoft Linker" and name: "Linker"4b:T4f9,"AppLaunch.exe" touched "Group Policy Object" (Path: "HKCU\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}") "AppLaunch.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}") "AppLaunch.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "AppLaunch.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "AppLaunch.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "AppLaunch.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "AppLaunch.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "6nW2ca8.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "6nW2ca8.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "6nW2ca8.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")4c:T16cb,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "gG7nW35.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1eb74op8.exe" file has an entrypoint instructions - "call 0x408942,jmp 0x4082c1,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x427bc8,mov dword ptr [ecx], 0x42743c,ret ,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x427bd8,mov dword ptr [ecx], 0x427398,ret ,lea eax, [ecx + 4],mov dword ptr [ecx], 0x427304,push eax,call 0x40b8f3,pop ecx,ret ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x408447,push 0x43437c,lea eax, [ebp - 0xc],push eax," "TI4ji42.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4oC416uQ.exe" file has an entrypoint instructions - "call 0x508e02,jmp 0x5085cf,cmp ecx, dword ptr [0x58a048],jne 0x50875e,ret ,jmp 0x508f35,push ebp,mov ebp, esp,and dword ptr [0x58c3d0], 0,sub esp, 0x24,or dword ptr [0x58a050], 1,push 0xa,call dword ptr [0x5560e0],test eax, eax,je 0x508933,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "xu3MF69.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "6nW2ca8.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "5ok1AV0.exe" file has an entrypoint instructions - "call 0x408942,jmp 0x4082c1,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x427bc8,mov dword ptr [ecx], 0x42743c,ret ,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x427bd8,mov dword ptr [ecx], 0x427398,ret ,lea eax, [ecx + 4],mov dword ptr [ecx], 0x427304,push eax,call 0x40b8f3,pop ecx,ret ,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x408447,push 0x43437c,lea eax, [ebp - 0xc],push eax," "FANBooster131.exe" file has an entrypoint instructions - "call 0x40ff23,jmp 0x40f992,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x413014],bnd jne 0x40fb1b,bnd ret ,bnd jmp 0x40fb49,push ebp,mov ebp, esp,push 0,call dword ptr [0x415068],push dword ptr [ebp + 8],call dword ptr [0x415064],push 0xc0000409,call dword ptr [0x415014],push eax,call dword ptr [0x415008],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x410540,test eax, eax,je 0x40fb62,push 2,pop ecx,int 0x29," "3OR33jN.exe" file has an entrypoint instructions - "call 0x403250,jne 0x403256,je 0x403256,mov edi, 0x4c4835f,mov ebx, dword ptr [esp - 4],jmp 0x403269,add al, 0x81,jmp 0x4032b3,xor al, byte ptr [eax],add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xbb8ce2e5,dec eax,push 0x30,jne 0x403280,je 0x403280,cmp al, 0x68,js 0x403209,mov edx, dword ptr [esp],add esp, 4,jmp 0x40328e,shr byte ptr [ecx], 0xc0,jmp 0x403292,sub bl, 0xf9,rol byte ptr [edx - 0x3a3bfa15], 0xa5,mov dword ptr [edx + 0x64], edi,add eax, dword ptr [edx],je 0x4032a5,jne 0x4032a5,adc al, 0xf6,cmpsd dword ptr [esi], dword ptr es:[edi],daa ,daa ,push dword ptr [eax + 0xa4],jne 0x4032b1,je 0x4032b1,"4d:T7b0,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "gG7nW35.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "gG7nW35.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "TI4ji42.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "TI4ji42.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "xu3MF69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "xu3MF69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1eb74op8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1eb74op8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3OR33jN.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3OR33jN.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4oC416uQ.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4oC416uQ.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5ok1AV0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5ok1AV0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6nW2ca8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")4e:T520,Found string "" (Indicator: "text/javascript"; File: "KEDQBKRT.htm") Found string "" (Indicator: "text/javascript"; File: "KEDQBKRT.htm") Found string "" (Indicator: "text/javascript"; File: "KEDQBKRT.htm") Found string "" (Indicator: "text/javascript"; File: "KEDQBKRT.htm")4f:T53e,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00003676.00000E5C.524527.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003856-00000C25-23810396] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003856-00000BC1-23835662] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003268-00000BC1-31588833] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002584-00000BC1-24948899] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003676-00000BC1-32630478] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002528-00000C25-31229749] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00003440-00000C25-39747460] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00003440-00000C25-42853662] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00001716-00000C25-77134701]50:T5e9,Spawned process "gG7nW35.exe" (UID: 00000000-00003268) Spawned process "TI4ji42.exe" (UID: 00000000-00002584) Spawned process "xu3MF69.exe" (UID: 00000000-00003676) Spawned process "1eb74op8.exe" (UID: 00000000-00002528) Spawned process "AppLaunch.exe" (UID: 00000000-00003440) Spawned process "3OR33jN.exe" (UID: 00000000-00003364) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00002860), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00003520) Spawned process "4oC416uQ.exe" (UID: 00000000-00003352) Spawned process "5ok1AV0.exe" (UID: 00000000-00001156) Spawned process "AppLaunch.exe" (UID: 00000000-00002340) Spawned process "6nW2ca8.exe" (UID: 00000000-00001716) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00001824) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002556) Spawned process "iexplore.exe" with commandline "SCODEF:1824 CREDAT:275457 /prefetch:2" (UID: 00000000-00001536) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003920) Spawned process "iexplore.exe" with commandline "SCODEF:2556 CREDAT:275457 /prefetch:2" (UID: 00000000-00002524) Spawned process "iexplore.exe" with commandline "SCODEF:3920 CREDAT:275457 /prefetch:2" (UID: 00000000-00000728)51:T5e9,Spawned process "gG7nW35.exe" (UID: 00000000-00003268) Spawned process "TI4ji42.exe" (UID: 00000000-00002584) Spawned process "xu3MF69.exe" (UID: 00000000-00003676) Spawned process "1eb74op8.exe" (UID: 00000000-00002528) Spawned process "AppLaunch.exe" (UID: 00000000-00003440) Spawned process "3OR33jN.exe" (UID: 00000000-00003364) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00002860), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00003520) Spawned process "4oC416uQ.exe" (UID: 00000000-00003352) Spawned process "5ok1AV0.exe" (UID: 00000000-00001156) Spawned process "AppLaunch.exe" (UID: 00000000-00002340) Spawned process "6nW2ca8.exe" (UID: 00000000-00001716) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00001824) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002556) Spawned process "iexplore.exe" with commandline "SCODEF:1824 CREDAT:275457 /prefetch:2" (UID: 00000000-00001536) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003920) Spawned process "iexplore.exe" with commandline "SCODEF:2556 CREDAT:275457 /prefetch:2" (UID: 00000000-00002524) Spawned process "iexplore.exe" with commandline "SCODEF:3920 CREDAT:275457 /prefetch:2" (UID: 00000000-00000728)52:T54e,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "5ok1AV0.exe.2503033822") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")53:T5d85,"gG7nW35.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\gG7nW35.exe]- [targetUID: 00000000-00003856] "1eb74op8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1eb74op8.exe]- [targetUID: 00000000-00002528] "TI4ji42.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\TI4ji42.exe]- [targetUID: 00000000-00003268] "4oC416uQ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4oC416uQ.exe]- [targetUID: 00000000-00003352] "xu3MF69.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\xu3MF69.exe]- [targetUID: 00000000-00003676] "6nW2ca8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6nW2ca8.exe]- [targetUID: 00000000-00003856] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "5ok1AV0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5ok1AV0.exe]- [targetUID: 00000000-00001156] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00003440] "3OR33jN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3OR33jN.exe]- [targetUID: 00000000-00003364] "4lCu2zih0ca_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Fri Dec 8 16:54:36 2023 mtime=Fri Dec 8 16:54:36 2023 atime=Thu Mar 28 01:11:14 2019 length=102568 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00003440] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\posterBoxC8Q0hG4pT4Rhr\D87fZN3R3jFecookies.sqlite]- [targetUID: 00000000-00003440] "yhJcBPjnnBa_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "KEDQBKRT.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\KEDQBKRT.htm]- [targetUID: 00000000-00001824] "TarFE48.tmp" has type "data"- Location: [%TEMP%\TarFE48.tmp]- [targetUID: 00000000-00001824] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001824] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "a1OLcVhluEP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "sKtrEJAtiUM_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "kdJJeCwLfNb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "VOBFpi2zoQs_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "a_TNkY9RAW1_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "qR7guTNb9BC_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "aBIoq18cchP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "uI48pQbdqMg_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "GxGC52INhg0_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "qvzskUrYlYC_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_2_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002524] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "hNaGl-uOTME_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "~DF969A3ACE5B69651B.TMP" has type "data"- Location: [%TEMP%\~DF969A3ACE5B69651B.TMP]- [targetUID: 00000000-00003920] "~DFA45A265F97659D53.TMP" has type "data"- Location: [%TEMP%\~DFA45A265F97659D53.TMP]- [targetUID: 00000000-00001824] "g5tzaL2L6vO_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002556] "P-5OTatVTyC_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "~DFDBBDE0C22D7F65BC.TMP" has type "data"- Location: [%TEMP%\~DFDBBDE0C22D7F65BC.TMP]- [targetUID: 00000000-00001824] "~DF1A3DD2717DD66FC2.TMP" has type "data"- Location: [%TEMP%\~DF1A3DD2717DD66FC2.TMP]- [targetUID: 00000000-00001824] "~DF910B80F2AF79CEE2.TMP" has type "data"- Location: [%TEMP%\~DF910B80F2AF79CEE2.TMP]- [targetUID: 00000000-00002556] "~DF9BA0A7688228913A.TMP" has type "data"- Location: [%TEMP%\~DF9BA0A7688228913A.TMP]- [targetUID: 00000000-00003920] "~DFC00CFCBF30D840A9.TMP" has type "data"- Location: [%TEMP%\~DFC00CFCBF30D840A9.TMP]- [targetUID: 00000000-00002556] "EEh1AYcUYds_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "_D3D5DF93-95F1-11EE-B0B7-08002773E2E7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_B9ABDFF6-95F7-11EE-B0B7-08002773E2E7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "ysfm_2i9xtW_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_B9FCEFEA-95F7-11EE-B0B7-08002773E2E7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "EVmD_liOmwc_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "RecoveryStore._D3D5DF91-95F1-11EE-B0B7-08002773E2E7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._AAAA5D21-95F2-11EE-B0B7-08002773E2E7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._ECCA1AE7-95F3-11EE-B0B7-08002773E2E7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_2_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "passwords.txt" has type "UTF-8 Unicode text with CRLF line terminators"- Location: [%TEMP%\grandUIAC8Q0hG4pT4Rhr\passwords.txt]- [targetUID: 00000000-00003440] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002524] "information.txt" has type "ASCII text"- Location: [%TEMP%\grandUIAZ9p4VRlZaB0a6\information.txt]- [targetUID: 00000000-00003440] "information.txt" has type "ASCII text"- Location: [%TEMP%\grandUIAC8Q0hG4pT4Rhr\information.txt]- [targetUID: 00000000-00003440] "_B8FDD44C-95F7-11EE-B0B7-08002773E2E7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "jIh_meE3KX5Nx0WzbYfyJqAXT1kgEsAg.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\jIh_meE3KX5Nx0WzbYfyJqAXT1kgEsAg.zip]- [targetUID: 00000000-00003440] "qbeAV4SBwSLYR7e3z0gTMK1yDfUX9Imz.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\qbeAV4SBwSLYR7e3z0gTMK1yDfUX9Imz.zip]- [targetUID: 00000000-00003352] "Registry.pol" has type "data"- Location: [%WINDIR%\System32\GroupPolicy\Machine\Registry.pol]- [targetUID: 00000000-00003440] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00001536] "QcYlxMWQTQ-_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "3FPJ9YC_wUr_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "0ZOQmhGCKxB_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001536] "v75M7CPu9-P_1_.js" has type "C source ASCII text"- [targetUID: N/A] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00001824] "KPYUNCZF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\KPYUNCZF.txt]- [targetUID: 00000000-00001824] "QP4MP2L6.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\QP4MP2L6.txt]- [targetUID: 00000000-00001824] "F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5]- [targetUID: 00000000-00001536] "F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317]- [targetUID: 00000000-00001536] "35DDEDF268117918D1D277A171D8DF7B_0E3901F4E624FA7BA72E1374AD94C2CD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_0E3901F4E624FA7BA72E1374AD94C2CD]- [targetUID: 00000000-00002524] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00001824] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00001824] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00001824] "F2DDCD2B5F37625B82E81F4976CEE400_75B24FDC3C3C4FB8352671805786FA97" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_75B24FDC3C3C4FB8352671805786FA97]- [targetUID: 00000000-00001536] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002524] "35DDEDF268117918D1D277A171D8DF7B_41E82FA0D4E39B947578840880966784" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_41E82FA0D4E39B947578840880966784]- [targetUID: 00000000-00002524] "E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF]- [targetUID: 00000000-00001536] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002524] "C56CGB2S.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\C56CGB2S.txt]- [targetUID: 00000000-00001824] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00001824] "35DDEDF268117918D1D277A171D8DF7B_0E3901F4E624FA7BA72E1374AD94C2CD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_0E3901F4E624FA7BA72E1374AD94C2CD]- [targetUID: 00000000-00002524] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00001824] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00001824] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00001536] "35DDEDF268117918D1D277A171D8DF7B_41E82FA0D4E39B947578840880966784" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_41E82FA0D4E39B947578840880966784]- [targetUID: 00000000-00002524] "E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF]- [targetUID: 00000000-00001536] "F2DDCD2B5F37625B82E81F4976CEE400_75B24FDC3C3C4FB8352671805786FA97" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_75B24FDC3C3C4FB8352671805786FA97]- [targetUID: 00000000-00001536] "F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5]- [targetUID: 00000000-00001536] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002524] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002556] "F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317]- [targetUID: 00000000-00001536] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002524] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001536] "9RQE8AAD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9RQE8AAD.txt]- [targetUID: 00000000-00002524] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002524] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001824] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002556] "26HUODCY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\26HUODCY.txt]- [targetUID: 00000000-00002524] "0VRI657R.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\0VRI657R.txt]- [targetUID: 00000000-00001824] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00001824] "0GJS9FG4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\0GJS9FG4.txt]- [targetUID: 00000000-00001536] "10WPYIZ4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\10WPYIZ4.txt]- [targetUID: 00000000-00001536] "YXDCBG1B.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YXDCBG1B.txt]- [targetUID: 00000000-00001536] "FGG2XQZL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FGG2XQZL.txt]- [targetUID: 00000000-00001536] "32OV07NZ.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\32OV07NZ.htm]- [targetUID: 00000000-00001536] "ELAFIGYL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ELAFIGYL.txt]- [targetUID: 00000000-00001536] "N91460TN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\N91460TN.txt]- [targetUID: 00000000-00001536] "GXY34VNU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\GXY34VNU.txt]- [targetUID: 00000000-00001824] "QGST3TEC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\QGST3TEC.txt]- [targetUID: 00000000-00002524] "SOZM8ASD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SOZM8ASD.txt]- [targetUID: 00000000-00001824] "gpt.ini" has type "data"- Location: [%WINDIR%\System32\GroupPolicy\gpt.ini]- [targetUID: 00000000-00003440] "I9EN3P19.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\I9EN3P19.txt]- [targetUID: 00000000-00000728] "AFAFFP8E.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\AFAFFP8E.txt]- [targetUID: 00000000-00001536] "FG8C5213.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FG8C5213.txt]- [targetUID: 00000000-00000728] "XAENY4SZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XAENY4SZ.txt]- [targetUID: 00000000-00002524] "2CSPV0M1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2CSPV0M1.txt]- [targetUID: 00000000-00001824] "S8SX47U3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\S8SX47U3.txt]- [targetUID: 00000000-00001824] "3XR6IANM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3XR6IANM.txt]- [targetUID: 00000000-00000728] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "8XXXXH0C.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8XXXXH0C.txt]- [targetUID: 00000000-00001824] "T7F0TFXC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\T7F0TFXC.txt]- [targetUID: 00000000-00000728] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00003440] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00003440] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00003440] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\posterBoxZ9p4VRlZaB0a6\D87fZN3R3jFecookies.sqlite]- [targetUID: 00000000-00003440] "CabFE47.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabFE47.tmp]- [targetUID: 00000000-00001824] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_2_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_2_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "passwords.txt" has type "UTF-8 Unicode text with CRLF line terminators"- Location: [%TEMP%\grandUIAZ9p4VRlZaB0a6\passwords.txt]- [targetUID: 00000000-00003440] "favicon_3_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "KYE981RA.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\KYE981RA.htm]- [targetUID: 00000000-00000728] "DIR97YHH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DIR97YHH.txt]- [targetUID: 00000000-00001536] "bscframe_2_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A]54:T974,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")55:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")56:Te12,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "88F06C42B6A5ABB4BCA8D456BBDB0B0D"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")57:T462,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\gg7nw35.exe" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6nw2ca8.exe" "gG7nW35.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\ti4ji42.exe" "gG7nW35.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5ok1av0.exe" "TI4ji42.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\xu3mf69.exe" "TI4ji42.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4oc416uq.exe" "xu3MF69.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\1eb74op8.exe" "xu3MF69.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3or33jn.exe" "1eb74op8.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "AppLaunch.exe" reads file "c:\users\desktop.ini" "AppLaunch.exe" reads file "c:\windows\system32\grouppolicy\gpt.ini" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "AppLaunch.exe" reads file "c:\users\%osuser%\desktop\desktop.ini"58:T5e7,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\UxTheme.dll" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gG7nW35.exe" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\System32\sechost.dll" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "\Device\HarddiskVolume2\88F06C42B6A5ABB4BCA8D456BBDB0B0D.EXE.LOCAL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "\Device\HarddiskVolume2\CABINET.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to touch file "C:\Windows\System32\cabinet.dll"59:T972,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "C:\UxTheme.dll" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINMM.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\SAMCLI.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\MSACM32.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\SFC.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\SFC_OS.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\DWMAPI.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GG7NW35.EXE" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6NW2CA8.EXE" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "C:\Cabinet.dll"5a:T991,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\88F06C42B6A5ABB4BCA8D456BBDB0B0D.EXE.LOCAL" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\88F06C42B6A5ABB4BCA8D456BBDB0B0D.EXE.CONFIG" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "C:\88f06c42b6a5abb4bca8d456bbdb0b0d.exe.Local\" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "C:\88f06c42b6a5abb4bca8d456bbdb0b0d.exe.Config" "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "gG7nW35.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gG7nW35.exe.Local\" "gG7nW35.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gG7nW35.exe.Config" "gG7nW35.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "gG7nW35.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "gG7nW35.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GG7NW35.EXE.LOCAL" "gG7nW35.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GG7NW35.EXE.CONFIG" "gG7nW35.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "gG7nW35.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "TI4ji42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\TI4ji42.exe.Local\" "TI4ji42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\TI4ji42.exe.Config" "TI4ji42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "TI4ji42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV"5b:T42e,"AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "262648" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "26ff58" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2c34260" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "4oC416uQ.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2c8990" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "4oC416uQ.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2ce510" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "4oC416uQ.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3377c0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}5c:T4854,Found requests in header "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:pEqFYaDszkbSTNABslCbm9-Kv2b5ow:gkLC2sMSgSdoSbV8Connection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3e70ErLr7UbAkp_okUjBhr6XQdhywlCrP8144Bui9vwEsh77TYwMK7EyBw0UW9FRGuhwlBrA HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:pEqFYaDszkbSTNABslCbm9-Kv2b5ow:gkLC2sMSgSdoSbV8"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:Gg65BnakqrY3dGb6wwGx4nifSMTSfg:AY815iieLBMNdupGConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1O49KD_mv6sUIwTtjY8-iDz7cG6R5pjAf5eqNpgxrPvZqlTkdDygLv03gEx9z5UI3Ugwrf HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp0e_KUJPgPTITNnq7saulVbKGUMGZvMmlNsDhx45JzPhbvq-5ywZh5FaCJGnTN7h-hC842Fow&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1610762060%3A1702058219313002&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi; OTZ=7329270_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi; OTZ=7329270_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-7667392207034910992&bl=boq_identityfrontendauthuiserver_20231203.08_p0&hl=en-US&_reqid=70195&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1594153583:1702058217705908",null,null,"ASKXGp3640HML6K2kttyM5m-qVAeBHc5AU1QHkpjIhSlyxhuDLcQ1faFL_Q4CUicg6ONrY_Ydwkm3Q"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi; OTZ=7329270_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/jserror?script=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fidentifier%3Fcontinue%3Dhttps%253A%252F%252Faccounts.google.com%252F%26followup%3Dhttps%253A%252F%252Faccounts.google.com%252F%26ifkv%3DASKXGp3640HML6K2kttyM5m-qVAeBHc5AU1QHkpjIhSlyxhuDLcQ1faFL_Q4CUicg6ONrY_Ydwkm3Q%26passive%3D1209600%26flowName%3DGlifWebSignIn%26flowEntry%3DServiceLogin%26dsh%3DS1594153583%253A1702058217705908%26theme%3Dglif&error=qb%60https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D-7667392207034910992%26bl%3Dboq_identityfrontendauthuiserver_20231203.08_p0%26hl%3Den-US%26_reqid%3D70195%26rt%3Dc%60400&line=Not%20available HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 8300DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi; OTZ=7329270_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/reporthttp4xxerror?url=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D-7667392207034910992%26bl%3Dboq_identityfrontendauthuiserver_20231203.08_p0%26hl%3Den-US%26_reqid%3D70195%26rt%3Dc&status=400&traceid HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 0DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi; OTZ=7329270_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/jserror?script=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fidentifier%3Fcontinue%3Dhttps%253A%252F%252Faccounts.google.com%252F%26followup%3Dhttps%253A%252F%252Faccounts.google.com%252F%26ifkv%3DASKXGp3640HML6K2kttyM5m-qVAeBHc5AU1QHkpjIhSlyxhuDLcQ1faFL_Q4CUicg6ONrY_Ydwkm3Q%26passive%3D1209600%26flowName%3DGlifWebSignIn%26flowEntry%3DServiceLogin%26dsh%3DS1594153583%253A1702058217705908%26theme%3Dglif&error=qb%60https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D-7667392207034910992%26bl%3Dboq_identityfrontendauthuiserver_20231203.08_p0%26hl%3Den-US%26_reqid%3D70195%26rt%3Dc%60400&line=Not%20available HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 8295DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi; OTZ=7329270_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi; OTZ=7329270_52_52_123900_48_436380; NID=511=QhOSjZu3rbJwDz1PicMqLXjJUBh2bXCRteh3vxPiF9RQ1mhUbyRNkG9SHPzwFl1oyjdy0ckP7VX93pZSWPwpU7YtAuG_C00WsPIknISoC7UE7xQENFnxEO9m084Ntws8rjNrrZCEIazbzwtOks29yWUuvvVUy3Ww0ZhhcYOupxI"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=3736414257112735813&bl=boq_identityfrontendauthuiserver_20231203.08_p0&hl=en-US&_reqid=70196&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1610762060:1702058219313002",null,null,"ASKXGp0e_KUJPgPTITNnq7saulVbKGUMGZvMmlNsDhx45JzPhbvq-5ywZh5FaCJGnTN7h-hC842Fow"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:rPNlGCbtMGCwk7rPU4PL55XNPyYGUQ:DVk1shOVXOR3iFIi; OTZ=7329270_52_52_123900_48_436380; NID=511=QhOSjZu3rbJwDz1PicMqLXjJUBh2bXCRteh3vxPiF9RQ1mhUbyRNkG9SHPzwFl1oyjdy0ckP7VX93pZSWPwpU7YtAuG_C00WsPIknISoC7UE7xQENFnxEO9m084Ntws8rjNrrZCEIazbzwtOks29yWUuvvVUy3Ww0ZhhcYOupxI"; in File: "SSL") Found requests in header "GET /generate_204?g-QxCQ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:X-hqGlL2WEMrBJL5Tu_m5TTe4eI3ag:EPL8MFRUKmZfr8_W; OTZ=7329270_52_52_123900_48_436380; NID=511=QhOSjZu3rbJwDz1PicMqLXjJUBh2bXCRteh3vxPiF9RQ1mhUbyRNkG9SHPzwFl1oyjdy0ckP7VX93pZSWPwpU7YtAuG_C00WsPIknISoC7UE7xQENFnxEO9m084Ntws8rjNrrZCEIazbzwtOks29yWUuvvVUy3Ww0ZhhcYOupxI"; in File: "SSL") Found requests in header "GET /generate_204?tmIoTw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:X-hqGlL2WEMrBJL5Tu_m5TTe4eI3ag:EPL8MFRUKmZfr8_W; OTZ=7329270_52_52_123900_48_436380; NID=511=QhOSjZu3rbJwDz1PicMqLXjJUBh2bXCRteh3vxPiF9RQ1mhUbyRNkG9SHPzwFl1oyjdy0ckP7VX93pZSWPwpU7YtAuG_C00WsPIknISoC7UE7xQENFnxEO9m084Ntws8rjNrrZCEIazbzwtOks29yWUuvvVUy3Ww0ZhhcYOupxI"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.bing.comDNT: 1Connection: Keep-AliveCookie: SRCHD=AF=IESS4A; SRCHUID=V=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1; SRCHUSR=DOB=20220131&T=1643622536000; _UR=D=0; SRCHHPGUSR=SRCHLANG=en&BRW=HTP&BRH=S&CW=1024&CH=472&SW=1024&SH=611&DPR=1&UTC=60&DM=3&WTS=63779219336&HV=1643615337"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.1_ex_vpT7l8.es5.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFMmSVi-s7WpReqz8Tw1urTAT-5xQ/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.1_ex_vpT7l8.es5.O/ck=boq-identity.AccountsSignInUi.7SqRI1GGGCM.L.I11.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH9QarbxhX3J_nvBUFSq4ZB0XWSmg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.1_ex_vpT7l8.es5.O/ck=boq-identity.AccountsSignInUi.7SqRI1GGGCM.L.I11.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH9QarbxhX3J_nvBUFSq4ZB0XWSmg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.1_ex_vpT7l8.es5.O/ck=boq-identity.AccountsSignInUi.7SqRI1GGGCM.L.I11.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH9QarbxhX3J_nvBUFSq4ZB0XWSmg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.1_ex_vpT7l8.es5.O/ck=boq-identity.AccountsSignInUi.7SqRI1GGGCM.L.I11.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH9QarbxhX3J_nvBUFSq4ZB0XWSmg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")5d:Tc27,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003440-00000C26-40886578") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003440-00000C26-46498824") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00003440-00000C26-46500321") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00003440-00000C26-46501038") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00003440-00000C26-46501771") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00003440-00000C26-46502489") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00003440-00000C26-46503918") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003440-00000C26-46504627") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003440-00000C26-48692265") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003440-00000C26-48693114") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003440-00000C26-48693903") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003440-00000C26-48694673") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003440-00000C26-48694673") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003440-00000C26-48694673") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003440-00000C26-48696204") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003440-00000C26-48696204") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003440-00000C26-48697732") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003440-00000C26-49243365") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp")5e:T8a12,"GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" "HTTP/1.1 200 OKDate: Fri, 08 Dec 2023 17:55:49 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: keep-alivex-iplb-request-id: AC458783:4C12_93878F2E:0050_657358A5_33620C4:0401x-iplb-instance: 30783CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a2WXb7hb1WyGLWoCnoAOtlc5gkGiPi07IbnG0Hs56rjAlpK8Up7cfwaaMVgNt2gHNrh%2BydXG0Fl1OVz0IfhbqIH45jkN8AC%2FpCWrNvjCakYQBLhv0LJVVJXHsQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8326e1a99e65169e-SJCalt-svc: h3=":443"; ma=864004f{"status":"ok","demoInfo":{"error":"over query limit please try again later"}}" "HTTP/1.1 200 OKDate: Fri, 08 Dec 2023 17:55:50 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: keep-alivex-iplb-request-id: AC45869F:71B4_93878F2E:0050_657358A6_33D2297:BDC8x-iplb-instance: 30782CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yhBVBCFARkwfHjrBATBkxDQR8bFYQHpvSofk8gEAgttwH8sDNa%2BJV%2B%2B6jCAD3ilKgk8FPVQBiq%2F96gQCYCNFc6lgwObxbuD6ysp5txI4bl%2FT7DU%2FPxbSQFQSdQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8326e1b22d5e17da-SJCalt-svc: h3=":443"; ma=864004f{"status":"ok","demoInfo":{"error":"over query limit please try again later"}}" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:pEqFYaDszkbSTNABslCbm9-Kv2b5ow:gkLC2sMSgSdoSbV8Connection: Keep-AliveDNT: 1" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3e70ErLr7UbAkp_okUjBhr6XQdhywlCrP8144Bui9vwEsh77TYwMK7EyBw0UW9FRGuhwlBrA HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:pEqFYaDszkbSTNABslCbm9-Kv2b5ow:gkLC2sMSgSdoSbV8" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:pEqFYaDszkbSTNABslCbm9-Kv2b5ow:gkLC2sMSgSdoSbV8;Path=/;Expires=Sun, 07-Dec-2025 17:56:57 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-pVMvEYtrnyC1FET0LDtTCQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Fri, 08 Dec 2023 17:56:57 GMTExpires: Fri, 08 Dec 2023 17:56:57 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j00000001�0000000100000000100000001�00000001�00000001001Bd8!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Fri 08 Dec 2023 17:56:57 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3e70ErLr7UbAkp_okUjBhr6XQdhywlCrP8144Bui9vwEsh77TYwMK7EyBw0UW9FRGuhwlBrAStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: cross-originContent-Security-Policy: script-src 'nonce-B-3jic--E0RBPQWfw1d-Lw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Fri 08 Dec 2023 17:56:57 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: same-sitePermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-vVCr__g5mvElcp1Ug7Wh9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Report-To: {"group":"AccountsSignInUi" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionContent-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�00000001000000010011a2e��=iw�Ʋ��+��^�،!̽��c�u��|ԇ��{|,�Ke�R�r�L�\->��A�'�;�gwE�Ee�98��ܕ(�sp��p{S�؋Uv/��}N�9��F77%��[��i~}�I��O��n��<]��=q��?ѐ��O5��p��k|�w4?�x�{��Cٯ�R<7�i! �R%��k�n��=ztT��)>�W�˱a0��E3�nZͳ��*�#��}ȲE��F��y��x��!.c�!WcnG��Ա��\�=r�b�²?r�)�J9�|rB��=��`�͓g�3m�˽}�dZ菫O|O�0P�bo��_O��a�(�>��"c�3�-$�ن��P�l1�V�&#ѹ>��{!�!�ƺ��O��\��l�Hlsܿ2[ț4iz|��GL��d}O�u��6�|O�}$Z��#�Q��O�޾C��!�\�_��*_�=n��%����O��xWH��wa��toL��$��oDE�4�|�/��H�V�n`��\+4�r/��婠6TEu�{ZGʯ��^ٮ|M��RE��D��d�c�F��-��HD�xK�]m5m�̦*n��^�B�ē~k��(��[��E��0)�6=#��e��t�l��ߎ��1��1��k2�^Pv��!�r�tC��E��L�M�\��>��7��??%n$)T��`y�Ť쁇3��&lY`��!��q�0I�K�hn��}�.l��s�*�", "h��z&��T�� VJ��Y��0p��YYc�n��Xn�p��I��N'��~[��d��ݽ,�n�W�8��x�//�@�Έ�$��,$��{!��n/ <�˜0"�ұG��/��K��ӫݟ�-�~9m�k37A��L:��d��dqO70�4��5��OR%�?�1�û��_�:��9��}��;��!�i%��4�V�k�ꞝJ��44&-��i�Y�V�G��b�٭*�E��i\\�]u8�m��˗}Y�:V8��'v[{t�Q��Dた�~~uFr�/��g��RTo��7�T�f��k��}��/��Sy��~)��w��S��jX��5z��1�k<]��~�J�2jN�ghh�Nԓ/��7��k^��OO��s�|"T?�/N-�d{�]�B��t��WgZ&��꟒ƃ��P��ؗ�;�43/Ѭ)�d�N�.��6�Q�v,Et~�Co"j�� C> v!~#]�v�iwEC��G)��5r��[\�u~��xL�C��Z��K�� Ss��3��et4N�#�<��k�!�}��3(;S�7A�3��{z@u�e]"�<�F��%�ٟ�ا~��.5��i��l�Ä�^�&��7t^v��3��;��m�yz�Aֱ�As!�|��P�ʤI)ζ�t��?#��}�[y��¬��T��`0�_��9�e/#P��K]|~ iB��[m1f�hj:[�v�:e�rb��NQ|!xyEj �T�+��<��_+�ѫcџ�m��_��L��R�zˎ��|}n[�M�D汦�*��Y�՟B8�rݩ��r��䆐��C~}��1V4��G�L��L��A��r3H9�f��}��Ɗ��&M#̱��=�`�0�q�h�U�EvLW�= ��f��X* 6�y��)@e�/dV�.C�c�n��$�O��9��'�\��OO��Xp,`��ooT�;�tF��U�T�:v1�g?~0w��Bn��ʒN4�@mhu�Z�l��\�4YԎ`;?׉��K�d��z��(�+i�a��XE��p�n��M��3>�]� �HhZ@�\��c�_��p��p��>��ea��ϱKP��G�"�t]v�_Y�&L�^��6��/,��J{��K�%�yU�8}��Q3��:��[v�p�It�`�W��Z�pΔ��<]�pGGG��|;�q�1C�ѫ�`t��@S��.yK��]}��T��h��Q��?�̃��L�զfN�2�)T��;=l琳\PD�oww4��O��e��x�;��8�u��Bs�PS��N��Ń�ގ��v��", "�^��6?�-�Y�+�ß7�h,M�;ZcQ��u�\�1��G��|�uzX�ox��i��O"J3��^�kD&/�z�lf��a�K{��ug>��q#(�o�[��$��%0U��=Ƃ9�E��f��h$Sah��xkZ��"2z��e�|)��|!�e�f3��6N�j��S�a��p96�M�`(��ɋc̶c�S,�o��_V��a�"��R�~y��X,�&��& :��5}��//�[��9��&1��-��[4�0n�n�$]��1.�w1VT��C��N��M�V�@,��p��q1�2j4��z�& @�r+z!!k6��B��w��~X(�� mʌ{{�x>fd��1ŕ5;E='��g�T�!Rg��!�D�]-��v��:c��U�Q��:(J�y��fN!��o��2UfO�#�c�y`C�:�D�5 E��\��#��S��%a@#��R'n�l�<�ף�Z��T�v&z�]UmE�KXMAcޒ��*��m�ޅ��F�:�|̈��-C�?'��a%��R._�f�a�E�`4qo$��b��l4ɔ=��{��ʞ(��5��\H�A5�A�~_0&X��ָrhq��n�_Xr��(M��G��5qh��ue��}d)N��m�в��6l�"ѡ0K��2(�P�U[�O��V��"C#VET7��.j�Ld_��!I�a�a!��x]Je��g��l׳eg�Z�>��j}�&� ��ѧ��C�=j�*�Dcx��r�7�r;�Y��dF�di�[)��AVѤ�sh;�cH"��'qDw<_�O�/�z�z�^W�O�O��{" "l�4=؎i�QA�+�Q��=[@��Tx_k��mi�[��{M_;��f��u�-��}�R��E�K��-��[��u��\��@u0)�k�{9��6\�M,��IJ��"y��lt�b{{��x3�b�M��;[�\x�mf1j�]��֒�M�.F@![�Je��m��>j��~�?�]1ܜw��\��F��+�ꚢ��Sc'�i{��deq�,��&�~c(��[$�ý�@�̐9�4E�Tq�_�k�L��-b�Cnx#̢sߺ??!��xvm��0�ίXO8Kc�a��w8+�a�)P'�L�D��G]l�$�_�\sRZ3��#��!�Q�b��Α��K1�r#�%��{��J6�&�˱K�[�)��%8u��g�*-[�*��wE��5�W�c��b7��D+E�%�-��3�M�J�NC��(jm2��5�~�q�Nn٥F��F��e��b�z!��C��֒>J2�=wQYz��{8�;��!װ'�Ӛa8}�z?%ųy�uG��H�<�_J��P��y��犙��?�&��H*_�ک�{=��VςW!4��Dw��0��м��1��l��J�g��S$��8(�7�G�[��n�汇�)V#Ѣ�O ��jO�:=��92G��w<��m��k�orH��7=��<��>��k�޶>s�G��O��̳xf��ʗe6W�w82r�F�G��ެ�=��D7��`C�4��uZ�2��ٰ�� E�/��n�BZ��0�5��Q��]�T�N>��.� M��34Md��z�)V�U �c��8�A��-Y�Y�U`�R�&��5U��l��66{p'��(_VD�H�s/��l��", "��ym��l��(�X$�=�R��}��ۤU�=�M��+�`|��O�?VFEi�DFEG��40��`�$�[Iq��,L<��}��PVK�sc� ��۬+�@�(Aںދ�{�:��4{��8��C�Ч'i��`��8�\��@f�!�<�R[��v��L�J��|T��;^\�sJUE��~b�ɅEGer\f3��N)�%��U|�ǚ��V��s�>Ԗ�N��1��lm�@�F��N�2"T3�6�w;^�0�:G��\�#/�^' efUQ�vR��EKy�N:$��VI;�O�r.��.�*��5 ��P�V�Zj�9q�u��^��V՜��h�/�Xt��8g�Hk� �w4��Y�Ƽ�R`��Ac��@�Q.|Wy��CoY^��ͽ� /��%/�]��D��l"`�#v�HsyԺa�'!�n��X��Aص:�d�$g�q��N;�H��,�)}�Rqi�R�~��A��[�s9�(;��!��r8/0�;��l5�@A�r4#B5'q3�[.�kD�X�J�w��;ht˂T�Q�!CV�c��吿��R��ޗƧo%�5H��c�IY��/�^�H�", "��Hҷ��D�o��wg��bN��b�_S��p-=w��|έ��WK.��0��^�~>=�臡��ӻ��z��ԝ\��(��Z��x�^E�[c��JmOԗ�kza.?�;��0��jvu��1�gP�k��)��a�̸��'�U��O�J/f!f�rF��Ƃ%&�Be��q;��㻻W�)R��8q�U>��O�i2��y6��+Y��OE�� h��)P�U�ɢ8��[�$-�*��Iw��7ųke��Te��0U��:��`I.\�/�a��zx�'i�8�e�?q�lS<��lֻ�g�h�� Q��j-R9�8N��>&��҃ϩ9͗��x)�y��l�S��4U<2�ױ�$@��P#(M6�^D=��r7�^ǳ�e��0,=6Ҿ�u�]6N[|7g?��gK}HM��/u��߃V�M�%��6��3_W`��͗QVe�"@�f��$aQ��7��y>��h9�ĕ��bif��i�>��b�7��Č�;��^֙}��Fq��t!>2?[��ASu�M�iJ��&.��q�H~��@�z�0�˥eɺ��؆n��JC�c��3��9-w�b��S��m�8^f�jOi<�)w|j�2��~M{��S�l�*x�72�i�N,��E�-�Hn�J��?�;�Ժ^�/�S�-&��S�o0�̲pן��w��lxC��o(S�@1��,Q3�ǼT�i{�C72�wd4��:p�;�(�J Zs��4��*B��.UW��Tn�k�_o��.Ĳ�3�Y��b�~c�PE�L��[�n�\�H�]t��?��*NN:�/�n�eQY�+�Ij*W�8:+��&t��#�W�$��!��c"��J�X�hV�5[�$`m��r1��`�Pؗ1-Yp�|NZF�E��[�]ș[w].�N��(��!�W��4J!A��C&�*��dh��z9�i��u��X��Q<��1�Z��>��(��,ŀ�-��tÚ�SZ,�R4h��t_�8��'�#��%Xq��;��t@��#�##��$*^��l`�C��|=I�@^&"��>/w�T�V��2��䊜wE6X�?ҷ�>��ZW��m�m4��#�p��>��[��I\�ZA#(c�*��ڥ�v(�G��m_��f�ۖy�L��>�`!��9_��w?1�;��" "��4�K|�W1W��$��9l?��0Μ��z�LƏ~��gΧ1�k&��=��[��D��Td��Ͱ��k�p#h�w�V{��=��غ�KU��e�t��?��" "00000001�00000001]00000001Y00000001�00000001�0000000160000000100000001�00000001+00000001�1�cb7�U��")i$��>��8>��xk�[y��M��sW��"W��hykS�dD��F��@7pB�o~��]�>��!JU�5li��/��h��/-��ǹ��A?��oZF�/g�=�hn�RP��0�:��X��tuN��V)*X��X�y�!5��XHM��U��*�4]،�:]4p��Ny�^v,}&�V�4kA*K59R�*(��[��0�qO�s��ؐRʷ��'��yf��#��P��X�w�C��ֲQ!�G�6 ��Rj�%S8�z@C��ں��T75�q�L�U�Ue3��8�_�r�3ꓛ��>�4 ��%�8<��:_m��5��v@�l�Vz�V8?�ed�p6-ڎ�is8ϰ��cl�l��5��MLg��zq$nb<��D+��*�lK�y��"�R�ݎ�Fאw�j^��}C��M<(��`uGA�3��(��kV�B��<0Z�K:�N��c��Q��TcI�Wg��Y*��ٓ��W�/Id��ѥXa�+®�?*��Ǻ�g�l�ޯ��Q��J73�/��FŢC6E��K:3�^��E�;I)NP�6~w9��.5��b�^C (�H1��j�!�;l�I��,�A��k||��O�'��X�s�K��q��$-��[]�K�k*�k;q�EAr?�/=e.7��`��n��f��6#�E��,��]#�"��$[��$�ǷhJ��8ǐ��l��J5�Gc�ϟ�O��9vpZ�R�nS�J��Evga��v"�,δ��{*IF"��iX#�Ul�oL]`��Ga�'I��Z��JW9嫬|�S��61�ǧ�ZJ}:[��ݫ�S9�![�U�Nq�W��j�^k"Z=�/�Yk��,J��N��՞�ȱO�W:��S&�3}��P��Mب}�SC��C�a��^+��g@��j��M�5�T�J��ƃ�>%x��*�3�P`&�.q��h��r:��^N�P;�[�SnCr��)��"��#��\è��[��&��-�C�$��sm�Q�?!��S��[=5d��⧇=c��?A;�rSd5K�a��W��ʳ�yڕ$xrnyFVu��9�Ђ��<8d�q�2��"S��U��ʫ�M��2�(Nf׆AV��j|�'Cí��.��5�uy��a8��c��ǳ�׊��F��U��Ok��J��F+��ʖ�%�4�7@��;p[�k�!צ��`u�?l��al�L�ܓQ��ﳃ��mN��k} �kR�G��R��74R�uq;�®��}^��Lh�<��t�FZՅ^\N�wۑ-�뇺[b�vz�_��V��>B��GT�=�h>V]0��yH��9��,��괒��9�@�Hh�mw��E�c��N��^s�?��z�D��h�@��?��q�v&�a�o(�*o�!~��DC��:�٦�ޥ�4/~O�R�L��m��%1k�P0�O��/>�:��Wg��U��>/��YeB��oW�մ��?�Y�GGI��|ZTz�w�S/ᒖ�z�~[>�I�i�K�f2��??�9��5��o��9�'S3h7��@L|w�:��*_��d��=��VIT|w-�B��MO��-B�'�T�a��MHk�і:�x��$�$�F?��;�n�k�Bi��9�E��h�/j��+yC�e�R��$�t�n`[�v��J��R&\��7?��s��>��Z5�d�a��f�XkB&�Ef�J��M��d�V)��z�I��n��l�; ^д�O��[��5��~D`ͳ$KWQ��)��HQ&qN�h��p?!��T�+�я��&�?��Xu��}~Qe(��G��!IŐ�~��wF?_�#̤��ƧP�W�A32��5[��f��*�{��_N'��1�zi��#�'�%�Q�CF��VyڞT�:ԟ��NX��D��R��*��h��Ir�^��b��#�&��cqK|S��j]�AYSf��&�'=��Xb�?_OӏK��^�굘�o~8��;��Y/J��`�f�1��ǧ��JXsjyu�4A�P��ݿ?�Q�{��J^RV�p�R.��%c��O#��Z}��F��[)�o��?*g��$��f�н��)L˫��oı(*^wP�׀�pM�P��5�b4�&zg��t@q�3�LÕ7+�;��v��B��p'm��]�k��ص��|��.a1�$r��^�cj��1;�E�", "�[��=��~�ᠢj��Q0fe��S��oG�aۧ:��Ař�O�޼��.�p��W΂@8��JfWwk��c8�p��pvy7�\��z��yA�!9b�5��΀3{�+�K��b0��>��`�_��N�T�k;��Zd�:Ae��0�~�9��!��q��[�in�xE2u;��!7��R>r��S8��#�a6o��O�� '!ӹ��W!S��h�]B8'͍/��R�{j��<�C"�n��g��ӿƛ`}�2,�'��YV�[�l�Ҳ*4L�B�Kq;-�m��ĭи�V��q#t��-��n�r�n��Mc3T�-o�=�6-CJ�3�0)BM)-"MAj�Z�bY��(M� ��4Ŗ�c�� կj�)��)H��w|ͧ)��@�)H�]KS,�cU�)��ңr8�{��Ć4r��D�EsB��߄MS:ŕ.�R ��4��a�L��)��)��E�瞧8�~�Ps O��#�%��_G}�� R��T%gcY!��2��"&Y9#!n��"�-)@��+�I@J��^9Ȍ�%E�<�8�^<�{J;b|ܴωB��`��`Z��5.�S�s�iL��<-��\��EP�Uc�,ʐ�{=��j@�)�X�|q>��Y��N�dȜ]��}X3Gd5�4�=��a�n5K}IM �ɦ@E�3��;S਩ÚG��Q��N8�L�e뾹ّ-�O0U�6�O2��uÓm%�4�^Gc@��[�}�(�t'�}��|�_��W'��$߽X�:�ρ��ti��I��Iq�I��0.@<��J��D�s.lE�a<%�¼��1�`��"�7N�6�[13Hg)�W��o>�Uk�/�7�o��!߄D��D��OA8�a��g��>�.�L��lہ�VG'\-��7>�T;�P��o��Уe��"W!I+�_�ޜ��+�|MF?��JJN�<�)�N�m��B*��v+�'�׶�^N��(e�t��w��!m>F2t��!rIN�ڌ�4I�gw�_��*��pi;�o�@�e�Ӣ��a��fZ kR��I_CM"E'��d0�O��Pp��"��:��,'Qϝ3V��89pI��C4"Cr#!�T�T�V8R��sn�/CPː[��B��!�52��;��A�!C��dh�>��I !��%��a��C�P�c[��B��5~��;��A��7��f^��I !��*,��(Qw�o��o��{��9z�0@�� D7��o�fE��Z�&�"f3gfG��˗�k��(I�a$�%y�I_]�W��$Վ+N2\1KP˩[��B��$�5��;K��A�c�$ӱ\�4�wJk��f@�F�%�.�{N:Չj��5�;�U��M��L�OP˫[��B��$�5��;O��A�Y[f:�˖�D�Aْ��?�wH�$��%�)u62�-�[�N�-��X�-z�!s��`�[Bl�nn��-U͊ %��\�4��ʖ��-̀ؒ .�ڷH��k�}��!�R�{zx0@-�Bl�C!s��`�^Bl�nn�/U͊ ��%��xyZ0ˁ.�h��K��5��Ϥ�Ɐ��G�~Mo_ٛ��@��ަ��Tq�#�]E�(�RL��ֳ��;�(Mo_�Eڏ��@@/��TDr�w�C/u]}�sc�K�\l��%�Wpn_,��\��iN�Ry�sdMʻ�c]��~�W�[og�'�ʨ��Z/�WF�zȟ��X��C��37d%�G��JX�8�JX��JXo��V2��v0n0�4(�,-n��ĸ��-K��,1n �ĸ!�c�=x7��e�=�%ŌU�3TYZ�Hei1��ŌS�3LYZ�(u��|�]Dͯy s�㗫��\�X�*�G(W�=.��Up��S��YX�b�%�õ��p-f��7\��|�=m˾�J��o�/@��,�O0�K��mi��x8��`~�D��3L�", "w){L��#P44��õuU�l��_~z��P��.�[o��4y|2�ߦ��z8[��:S��m�z��j�8�I�� ;~^-e��FxXl��ҋ�2��aq=�T��^o6��y�=��ܥv�W�Y��d{��~� tM�4�Xm��X�x�盯�t�)�<��Q�d��M|�4;싾f�Ɋ��^��ɫ�7��W�"�b79]�*��:[��ӭ��zj�Lno4͌Kӧi零�k>{��_%�?��r�r�j'e�ם7!^8T��z��P��/��$/�:�-�2��_x��߿{��E�'�^��C��$��"5f:T4708,Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "3X.Gm" Heuristic match: "~N5.gG" Heuristic match: "M6.ae" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XL0J0H" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Pattern match: "https://www.facebook.com/legal/license/aJoeSHn7XcN/__d" Pattern match: "https://www.facebook.com/legal/license/WRsJ32R7YJG/__d" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "https://t.me/RiseProSUPPORT" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "IESS4Abing.com/1024294378944031085610419731758630938742SRCHUIDV=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1bing.com/1024294378944031085610419731758630938742SRCHUSRDOB=20220131&T=1643622536000bing.com/1088404823347231085593429095039930938742bing.com/10" Pattern match: "0xUKUvavQqUreOv9Z..Blc1jq.j9.AAA.0.0.Blc1jq.AWUZ3OFD8gIfacebook.com/92173642855680310929202166112030310748206lhzZXJ4UFFJl9i8yVlRtx11facebook.com/921789234252831155282217017453031074820_js_datr6lhzZUA7Jd2CWSdnBQwBMGUufacebook.com/108934024733443115528622431" Pattern match: "MUIDB38756D22BBFF6F953F1D7EC3BAB36E3Ewww.msn.com/9216279654208031153270287537420531074823sptmarketen-us||us|en-us|en-us|en||RefA=A82114D15ACB49D5A67704BE3420FC60.RefC=2023-12-08T17:57:42Zwww.msn.com/102463997107231221868287584295531074823" Pattern match: "DVk1shOVXOR3iFIiaccounts.google.com/92173793364864312216662176737030310748207329270_52_52_123900_48_436380accounts.google.com/1089216328192031080855229423703031074820" Pattern match: ".google.com/92173953364864312216662343104218310748207329270_52_52_123900_48_436380accounts.google.com/1089216328192031080855229423703031074820" Pattern match: "9216279654208031153270287553045531074823MUID38756D22BBFF6F953F1D7EC3BAB36E3Emsn.com/1025279654208031153270287537420531074823USRLOCmsn.com/921763997107231221868287584295531074823" Pattern match: "0xUKUvavQqUreOv9Z..Blc1jq.j9.AAA.0.0.Blc1jq.AWUZ3OFD8gIfacebook.com/92173642855680310929202166112030310748206lhzZXJ4UFFJl9i8yVlRtx11facebook.com/921789234252831155282217017453031074820" Pattern match: "9216279654208031153270287553045531074823MUID38756D22BBFF6F953F1D7EC3BAB36E3Emsn.com/1025279654208031153270287537420531074823" Pattern match: "DVk1shOVXOR3iFIiaccounts.google.com/9217379336486431221666217673703031074820" Pattern match: "gkLC2sMSgSdoSbV8accounts.google.com/9217377336486431221666216017453031074820" Pattern match: "AY815iieLBMNdupGaccounts.google.com/9217378336486431221666216892453031074820" Pattern match: "0xUKUvavQqUreOv9Z..Blc1jq.j9.AAA.0.0.Blc1jq.AWUZ3OFD8gIfacebook.com/9217364285568031092920216611203031074820" Pattern match: "MUIDB3561D07728EF64AB20F9C396296B6581ieonline.microsoft.com/9216277654208031153270415534150131074822" Pattern match: "MUIDB38756D22BBFF6F953F1D7EC3BAB36E3Ewww.msn.com/9216279654208031153270287537420531074823" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088289091328031074820229298703031074820" Pattern match: "MUID38756D22BBFF6F953F1D7EC3BAB36E3Emsn.com/1025279654208031153270287537420531074823" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "www.maxmind.com" Pattern match: "https://www.maxmind.com/en/locate-my-ip-addressUser-Agent" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "connect.facebook.net" Heuristic match: "db-ip.com" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "ipinfo.io" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Heuristic match: "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3e70ErLr7UbAkp_okUjBhr6XQdhywlCrP8144Bui9vwEsh77TYwMK7EyBw0UW9FRGuhwlBrA" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3e70ErLr7UbAkp_okUjBhr6XQdhywlCrP8144Bui9vwEsh77TYwMK7EyBw0UW9FRGuhwlBrAStrict-Transport-Security" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1O49KD_mv6sUIwTtjY8-iDz7cG6R5pjAf5eqNpgxrPvZqlTkdDygLv03gEx9z5UI3Ugwrf" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1O49KD_mv6sUIwTtjY8-iDz7cG6R5pjAf5eqNpgxrPvZqlTkdDygLv03gEx9z5UI3UgwrfStrict-Transport-Security" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp0e_KUJPgPTITNnq7saulVbKGUMGZvMmlNsDhx45JzPhbvq-5ywZh5FaCJGnTN7h-hC842Fow&passive=1209600&flowName=GlifWe" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Permissions-Policy" Pattern match: "g.co/p3phelp" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Accept-CH" Pattern match: "www.facebook.comDNT" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "www.bing.comDNT" Pattern match: "https://aefd.nelreports.net/api/report?cat=bingcsp}]}Accept-CH" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yO/l/0,cross/EVmD_liOmwc.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yE/r/yhJcBPjnnBa.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yk/l/0,cross/P-5OTatVTyC.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/y1/r/4lCu2zih0ca.svg" Pattern match: "rsrc.php/v3/yu/l/0,cross/qR7guTNb9BC.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ye/r/a_TNkY9RAW1.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ya/r/GxGC52INhg0.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/yJ/r/a1OLcVhluEP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y7/r/uI48pQbdqMg.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yy/r/QcYlxMWQTQ-.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/g5tzaL2L6vO.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/ysfm_2i9xtW.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yH/r/EEh1AYcUYds.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-7667392207034910992\,3,[null,\S1594153583:1702058217705908\]],null,null,null,null,null,null,-3600,null,null,null,null,null,1],[1702060194000,null,null,null,null,null,null,[[[307,64002,nul" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\3736414257112735813\,3,[null,\S1610762060:1702058219313002\]],null,null,null,null,null,null,-3600,null,null,null,null,null,1],[1702060195000,null,null,null,null,null,null,[[[307,64002,null" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "https://ipinfo.io/" Pattern match: "https://www.maxmind.com/en/locate-my-ip-address" Heuristic match: "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Games\Battle.net" Pattern match: "https://assets.msn.com/config/v1/"" Pattern match: "https://+l+/OneCollector/1.0+function(t){return?+Object.keys(t).map" Pattern match: "www.bing.com" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.ef7dde432bed42c1b7db.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.f0dc8bbbc7b4d116660b.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.492a1c975dcc0f06cd68.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b069f413a8afbc8a21d4.js" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.7SqRI1GGGCM.L.I11.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/ed=1/rs=AOaEmlEn2P1ykj_C1zfxu6LUFjU0vDwdyA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.1_ex_vpT7l8.es5.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFMmSVi-s7WpReqz8Tw1urTAT-5xQ/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Pattern match: "https://www.internalfb.com/intern/invariant/+a+/;b.length" Pattern match: "https://fburl.com/debugjs" Pattern match: "https://www.facebook.com/legal/license/Ga6vBwdwgUx/" Pattern match: "https://www.facebook.com/legal/license/A4tfXiHOGrs/" Pattern match: "https://secure.facebook.com/:document.referrer,d=c.indexOf(/,8);c=c.substring(0,d);if(l(c)){d=new" Pattern match: "www.+" Pattern match: "www.novi" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.1i05gx70WEQ.L.B1.O/am=HwEWSRwbADFmlnP-nnFyGAAAAAAAAAAAYA3EDg/d=1/ed=1/rs=AOaEmlF8OE3vSs1OZuMYa4JPqZhfNkkaNg/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Heuristic match: "htt____account__.g00gle.c0m.__I3.___ignin.__'dentifier_'continue=http____j__F__Faccount__.google.co" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MW" Heuristic match: "@`.Eu" Heuristic match: "ttps://accounts.google.com" Pattern match: "www.facebook.com/login" Pattern match: "www.paypal.com/signin" Pattern match: "store.steampowered.com/login" Pattern match: "twitter.com/i/flow/login" Heuristic match: "ccounts.google.com" Pattern match: "www.youtube.com" Pattern match: "steamcommunity.com/openid/loginform" Pattern match: "www.epicgames.com/id/login" Pattern match: "https://accounts.google.com" Heuristic match: "\lit.ni" Pattern match: "https://steamcommunity.com/openid/loginform" Heuristic match: "tps://accounts.google.com" Pattern match: "https://www.youtube.com/" Pattern match: "www.youtube.com/" Heuristic match: "witter.com" Heuristic match: "ww.facebook.com" Heuristic match: "teamcommunity.com" Heuristic match: "ww.epicgames.com" Heuristic match: "tore.steampowered.com" Pattern match: "https://www.epicgames.com/id/login" Pattern match: "https://ac" Heuristic match: "diskcomp.com" Heuristic match: "iskcopy.com" Pattern match: "steampowered.com/login" Heuristic match: "edit.com" Heuristic match: "esrb.rs" Heuristic match: "fpb.rs" Heuristic match: "grb.rs" Heuristic match: "graphics.com" Heuristic match: "graphics.pro" Heuristic match: "ww.youtube.com" Heuristic match: "ivfsrc.ax" Heuristic match: "kb16.com" Heuristic match: "ww.paypal.com" Pattern match: "https://twitter.com/i/flow/login" Pattern match: "http://www.windows.com/pctv" Pattern match: "http://go.microsoft.com/fwlink/?linkid=53081" Pattern match: "www.microsoft.com/extender/help" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwl" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=70599" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=145837" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=57190" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=145765" Heuristic match: "Example: computer.fabrikam.com" Pattern match: "vista.gallery.microsoft.com/vista/SideShow.aspx" Pattern match: "http://www.icra.org/vocabulary/" Pattern match: "wmploc.dll/Offline_Buy.htm'res://wmploc.dll/Offline_MediaGuide.htm*res://wmploc.dll/Offline_Subscriptions.htm" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=32146res://wmploc.dll/ICW_ErrorPage.htm" Pattern match: "wmploc.dll/Service_Initial.htm" Pattern match: "wmploc.dll/Error_ServiceInfo.htm'res://wmploc.dll/Offline_InfoCenter.htm&res://wmploc.dll/Offline_AlbumInfo.htm" Pattern match: "wmploc.dll/Service_NoFunc.htm%res://wmploc.dll/Service_No_Local.htm" Pattern match: "wmploc.dll/RT_IMAGE/ServiceLarge.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png" Pattern match: "wmploc.dll/Blocked_AlbumInfo.htm&res://wmploc.dll/Blocked_AlbumInfo.htm,http://go.microsoft.com/fwlink/?LinkId=70183'res://wmploc.dll/offline_radioguide.htm" Pattern match: "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/" Pattern match: "redir.metaservices.microsoft.com/dvdcover/P" Pattern match: "http://redir.metaservices.microsoft.com/redir/buynow/" Pattern match: "http://windowsmedia.com/redir/findmedia.asp" Pattern match: "redir.metaservices.microsoft.com/redir/getmdrdvd/" Pattern match: "redir.metaservices.microsoft.com/redir/getmdrcd/?Bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?Ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=h" Pattern match: "redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/QueryTOCExt.asp1res://wmploc.dll/Offline_MediaInfo_NowPlaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=321507Optimized" Pattern match: "http://go.microsoft.com/fwlink/?linkid=8792" Pattern match: "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/QueryTOCNP.asp#Show" Pattern match: "http://windowsmedia.com/redir/services.asp?WMPFriendly=true" Pattern match: "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5" Pattern match: "http://www.w3.org/1999/XSL/Transform" Pattern match: "http://*.microsoft.co.jp" Pattern match: "http://microsoft.*.com" Pattern match: "www.treyresearch.net" Pattern match: "http://treyresearch.net" Heuristic match: "- fineartschool.net" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=226247" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=233329" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=228745" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=787651" Heuristic match: "GridParent.Height = Grid.Height + Grid.Top" Pattern match: "http://www.w3.org/2001/XMLSchema" Pattern match: "http://www.iec.ch" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=121315" Pattern match: "http://go.microsoft.com/fwlink/p/?LinkId=255142" Pattern match: "http://www.winimage.com/zLibDll"60:T7cd5,Found URL "https://accounts.google.com/tps://accounts.google.com/locationnotifications.exettps://accounts.google.com/mcupdate_authenticamd.dllmcupdate_genuineintel.dll\latelevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll52c64b7ec:\windows\system32\imm32.dllh;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-:\windows\system32\winspool.drvoca8rve=pdata\lo:\windows\system32\setupapi.dll:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dlldata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp") Found URL "https://accounts.google.com/javascriptcollectionagent.dll:\windows\system32\propsys.dlllocationnotificationsview.xmlmsspellcheckingfacility.exenettrace.pla.diagnostics.xmlportabledeviceconnectapi.dllportabledevicewiacompat.dll:\windows\system32\shell32.dllprintfilterpipelineprxy.dllprintfilterpipelinesvc.exepushprinterconnections.exerestartmanageruninstall.mofsystempropertiesadvanced.exesystempropertiesremote.exewindowsanytimeupgradeui.exeware\microsoft\oleaut:\windows:\windows:\windows\inf:\windows\inf:\windowsnsufficient" - Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginformttps://www.epicgames.com/id/login:\users\hapubws\appdata\local\temp\ixp000.tmp\6nw2ca8.exe:\users\hapubws\appdata\local\temp\ixp000.tmpnw2ca8.exelexecuterogramfilesx86\windows:\windowsidasyncinvokeidasyncinvokec:\users\hapubws\appdata\local\temp\ixp000.tmphttps://accounts.google.com-ms-winclsid\" - Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp") Found URL "https://accounts.google.com/tedinstaller.exedsandboxplugin.dllvs_version_infostringfileinfo040904b0companynamemicrosoft" - Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform:\windows\system32\userenv.dll:\windows\system32\profapi.dll:\windows\system32\psapi.dll:\windows\system32\comdlg32.dll:\windows\system32\oleaut32.dll:\windows\system32\iphlpapi.dll:\windows\system32\winnsi.dll:\windows\system32\uxtheme.dll:\windows\system32\shell32.dll:\windows\system32\ole32.dll:\windows\system32\apphelp.dll:\windows\system32\sspicli.dll:\windows\system32\samcli.dll:\windows\system32\msacm32.dll:\windows\system32\sfc_os.dll:\windows\system32\dwmapi.dll:\windows\system32\devobj.dll:\windows\system32\urlmon.dll:\windows\system32\imm32.dll:\windows\system32\msctf.dll\windows\system32\driverstorellusersprofile=c:\programdatarogramfiles=c:\program" - Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found URL "https://accounts.google.com/:\windows\system32\ieframe.dll\windows\system32\shell32.dlldevicepairingfolder.dlllowsetforegroundwindowionwttps://www.facebook.com/loginttps://accounts.google.com/senumerateprocessesexwionwttps://www.paypal.com/signinlocationnotifications.exettps://www.facebook.com/login\latelevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll52c64b7eviewtooltipclass32\imm32.dllh;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-:\windows\system32\winspool.drvoca8rve=pdata\lo:\windows\system32\setupapi.dll:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dllc:\users\hapubws\appdata\local\temp\ixp000.tmp;c:\windows\system32;c:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-32\;c:\users\hapubws\appdata\local\programs\python\python36-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python36-32\msiscanbuffer:\windows\system32\cryptbase.dllomspec=c:\windows\system32\cmd.exeroperty" - Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/ttps://twitter.com/i/flow/login:\windows\system32\propsys.dlllocationnotificationsview.xmlttps://www.epicgames.com/id/loginnettrace.pla.diagnostics.xmlportabledeviceconnectapi.dllportabledevicewiacompat.dllecurity=impersonation" - Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/ttps://steamcommunity.com/openid/loginformttps://steamcommunity.com/openid/loginformapi-ms-win-security-sddl-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/auxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/login\layers-ms-winclsid\" - Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found URL "https://acs.google.com/ftware\microsoft\windows\currentversion\shellcompatibility\objects\" - Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginvolume" - Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginc:\users\hapubws\appdata\local\temp\ixp000.tmphttps://accounts.google.com/fxlm0w" - Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found URL "http://timevalue705030)0'http://www.digicert.com/cps0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareincrsaca-2.crt0qhyfqc4i?9z6>.y8l(t$" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps0r.\ozj5u$^" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.dig" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc5soht" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl05s:/p1<92a@ef" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/z" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9nid" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o6" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0d" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^9ckxd" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,bq" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n5s)/d1r06x7y15sz&%2+jopijlf0cth" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!@" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:d" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0c" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrus6" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?@sp.m" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt02b" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s9d" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0?z,:hllej2b,l5s9sp" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-address2.23.140.1.2.22.23.140.1.2.12.23.140.1.2.3b" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressmozilla/5.0" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressuser-agent:" - Source: "00000000-00003352.00000001.68833.00250000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003352.00000001.68833.014A6000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003352.00000001.68833.014A6000.00000002.mdmp") Found URL "http://google.com/efaultelements" - Source: "00000000-00003352.00000001.68833.02DF0000.00000004.mdmp") Found URL "https://crowdstrike.okta.com/login/sessioncookieredirect?checkaccountsetupcomplete=true&token=20111pqwqn9ujt1wqkhsl26rltxp089oytgbpl1n0jdcb97obtqu9q3&redirecturl=https%3a%2f%2fcrowdstrike.okta.com%2fapp%2foffice365%2fexk9ntkuo6uni5bgc0x7%2fsso%2fwsfed%2fpassive%3fclient-request-id%3dc8155ed4-29e5-48bf-8aac-2b6f27cc7a81%26wa%3dwsignin1.0%26wtrealm%3durn%253afederation%253amicrosoftonline%26wctx%3dloginoptions%253d3%2526estsredirect%253d2%2526estsrequest%253drqiiazvrpwgturzpy6xxtagwurrcoiqrjffx7vsoaravtlzsw90cgl7u3jvn8u4d770kpeheqrcnzo6owugcradx8qm6ohusqrcn4otovxcyg8kf__d__-d3dumckgwqlu-3pqufcjqnqfiggysiqvcxhddeju_aru-ty7yoldtip-yxpu2cefv14pu1x8_q9mkhvfstclkjrmydtunzpg44z7g6shgf9bjorwlvq0q0fk92uxwl6usadgd4bsckwak9ans4shtdx7ziee1y8vcuxgg7seggoys8efg8ewoplzrg0ais2cm_inmxzasvus6esk8bw6hhgmt0f2mn4aw3agna-c2wai5vjwy-x0dz6zjoczyihnyccpwerssqmlfpmpbyjac8b41tnkgatohihni3x3xrhdewaylnq9z4f3mtqfino4jstisjtkwuh2f1mkqrhxi1xuj7ick5aahpf-k8qsxuwtlajf4jgr1gxlcki49mhjta99ijxqrkzxkbncssfn6wwnozvlpq2end988_nx_cnx68n1suvjvrefoxs9wnw5pvilx9z22z7mtofxvl7m5djzd1gpdxntm19dhgardhbxbfbvuypjxbo9ncq7n_avxw_rshq0_rxqw6i1aptcvqndu_aa2%26cbcxt%3d%26username%3dmarc.rivero%2540crowdstrike.com%26mkt%3d%26lc%3dw.mozie" - Source: "00000000-00003352.00000001.68833.02DF0000.00000004.mdmp") Found URL "https://www.mozilla.org/firefox/new/?utm_source=firefox&utm_medium=show-heartbeat&utm_campaign=yourfirefoxiscriticallyoutofdate.anupdateisrequiredtostaysecure.&source=heartbeat&surveyversion=56&updatechannel=release&fxversion=57.0.1&isdefaultbrowser=0&searchengine=google&syncsetup=0&type=button&flowid=37c564a0-21d8-4837-a397-4a04a1eb08bda" - Source: "00000000-00003352.00000001.68833.02DF0000.00000004.mdmp") Found URL "https://www.mozilla.org/firefox/new/?utm_source=firefox&utm_medium=show-heartbeat&utm_campaign=yourfirefoxiscriticallyoutofdate.anupdateisrequiredtostaysecure.&source=heartbeat&surveyversion=56&updatechannel=release&fxversion=57.0.1&isdefaultbrowser=0&searchengine=google&syncsetup=0&type=button&flowid=37c564a0-21d8-4837-a397-4a04a1eb08bdgro.allizom.www.wxph-bxpzzh5+q/mhhttps://crowdstrike.okta.com/login/sessioncookieredirect?checkaccountsetupcomplete=true&token=20111pqwqn9ujt1wqkhsl26rltxp089oytgbpl1n0jdcb97obtqu9q3&redirecturl=https%3a%2f%2fcrowdstrike.okta.com%2fapp%2foffice365%2fexk9ntkuo6uni5bgc0x7%2fsso%2fwsfed%2fpassive%3fclient-request-id%3dc8155ed4-29e5-48bf-8aac-2b6f27cc7a81%26wa%3dwsignin1.0%26wtrealm%3durn%253afederation%253amicrosoftonline%26wctx%3dloginoptions%253d3%2526estsredirect%253d2%2526estsrequest%253drqiiazvrpwgturzpy6xxtagwurrcoiqrjffx7vsoaravtlzsw90cgl7u3jvn8u4d770kpeheqrcnzo6owugcradx8qm6ohusqrcn4otovxcyg8kf__d__-d3dumckgwqlu-3pqufcjqnqfiggysiqvcxhddeju_aru-ty7yoldtip-yxpu2cefv14pu1x8_q9mkhvfstclkjrmydtunzpg44z7g6shgf9bjorwlvq0q0fk92uxwl6usadgd4bsckwak9ans4shtdx7ziee1y8vcuxgg7seggoys8efg8ewoplzrg0ais2cm_inmxzasvus6esk8bw6hhgmt0f2mn4aw3agna-c2wai5vjwy-x0dz6zjoczyihnyccpwerssqmlfpmpbyjac8b41tnkgatohihni3x3xrhdewaylnq9z4f3mtqfino4jstisjtkwuh2f1mkqrhxi1xuj7ick5aahpf-k8qsxuwtlajf4jgr1gxlcki49mhjta99ijxqrkzxkbncssfn6wwnozvlpq2end988_nx_cnx68n1suvjvrefoxs9wnw5pvilx9z22z7mtofxvl7m5djzd1gpdxntm19dhgardhbxbfbvuypjxbo9ncq7n_avxw_rshq0_rxqw6i1aptcvqndu_aa2%26cbcxt%3d%26username%3dmarc.rivero%2540crowdstrike.com%26mkt%3d%26lc%3dmoc.atko.ekirtsdworc.q/" - Source: "00000000-00003352.00000001.68833.02DF0000.00000004.mdmp") Found URL "http://google.com/moc.elgoog.n" - Source: "00000000-00003352.00000001.68833.02DF0000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/firefox/central/gro.allizom.www.zregzoijvhiw+place:sort=8&maxresults=10.wa4x9jwsxtz9https://www.mozilla.org/en-us/about/gro.allizom.www.8zz6qydhophy+https://www.mozilla.org/en-us/contribute/gro.allizom.www.oy2pjpuzktn7+https://www.mozilla.org/en-us/firefox/customize/gro.allizom.www.amyfd2pupuay+https://support.mozilla.org/en-us/products/firefoxgro.allizom.troppus.e_ivexntnjdv+place:type=6&sort=14&maxresults=10.f8cyvllykf2q" - Source: "00000000-00003352.00000001.68833.02DF0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003352.00000001.68833.02DF0000.00000004.mdmp")61:T7a5,Found string "GET /demo/home.php?s=67.218.111.202 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Fri, 08 Dec 2023 17:57:19 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Fri, 08 Dec 2023 17:57:18 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Wed, 06 Dec 2023 15:07:35 GMTExpires: Thu, 05 Dec 2024 15:07:35 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 182967Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")62:T10ed,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZR" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9J" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9J" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpg" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"63:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: yhJcBPjnnBa_1_.js64:T4d0,"88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindNextFileW" with parameter gG7nW35.exe (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindNextFileW" with parameter 6nW2ca8.exe (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00003856) "88f06c42b6a5abb4bca8d456bbdb0b0d.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003856) "gG7nW35.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003268) "gG7nW35.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003268) "gG7nW35.exe" called "FindNextFileW" with parameter 5ok1AV0.exe (UID: 00000000-00003268) "gG7nW35.exe" called "FindNextFileW" with parameter TI4ji42.exe (UID: 00000000-00003268) "gG7nW35.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003268) "gG7nW35.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003268)65:T667,file/memory contains long string with (Indicator: "base64"; File: "GxGC52INhg0_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "hNaGl-uOTME_1_.js") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "base64"; File: "yhJcBPjnnBa_1_.js") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found string "IAESCheck" (Indicator: "aes"; Source: "00000000-00001716.00000000.69562.696C1000.00000020.mdmp") Found string "3desc" (Indicator: "3des"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002528.00000001.66342.00070000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00002528.00000001.66342.00070000.00000004.mdmp") Found string "system.security.cryptography.primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002528.00000001.66342.00070000.00000004.mdmp")66:T48f,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp")67:T5e1,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "5ok1AV0.exe.2503033822") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "5ok1AV0.exe.2503033822") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")68:Tf87,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")69:T51a,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp")6a:T5a7,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")6b:Tdcd,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "00000000-00001156.00000000.69187.00B61000.00000020.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")6c:T446,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp")6d:T462,Found string "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Outlook\RoamCache\*.*" (Indicator: "\appdata\local\microsoft\outlook"; Source: "00000000-00003440-00000C27-15859025145") Found string "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Outlook\RoamCache" (Indicator: "\appdata\local\microsoft\outlook"; Source: "00000000-00003440-00000C3A-15860447786") Found string "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Outlook\*.*" (Indicator: "\appdata\local\microsoft\outlook"; Source: "00000000-00003440-00000C27-15862502354") Found string "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Outlook" (Indicator: "\appdata\local\microsoft\outlook"; Source: "00000000-00003440-00000C3A-15863846908") Found string "%TEMP%\grandUIAZ9p4VRlZaB0a6\Files\AppData\Local\Microsoft\Outlook" (Indicator: "\appdata\local\microsoft\outlook"; Source: "00000000-00003352-00000C38-20277236175") Found string "%TEMP%\grandUIAZ9p4VRlZaB0a6\Files\AppData\Local\Microsoft\Outlook\RoamCache" (Indicator: "\appdata\local\microsoft\outlook"; Source: "00000000-00003352-00000C38-20280577590")6e:T1332,Found string "information.txtmtiN?passwords.txtTy"0r.Y\" (Indicator: "password"; File: "qbeAV4SBwSLYR7e3z0gTMK1yDfUX9Imz.zip") Found string "No Caps LockHCaps Lock is on, which may cause you to enter your password incorrectly." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Use Internet connection: {0}/Dial-up or broadband with username and password" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password, and be available to all users." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Enter Your Dial-Up PassworddEnter the password for the connection you selected. You must use the keyboard to enter the password.P" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Confirm Password5These passwords do not match. Re-enter the passwords./Manually Download the TV Program Guide listings" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Windows Media Center requires an Internet connection with a saved password for all users to automatically download TV Program Guide listings." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "This feature is not compatible with password-protected screen savers. To use this feature, disable the password protection on your Windows screen saver." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Username or password error" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "The username or password entered does not appear to be correct. Verify that the username and password are valid for the shared folder on the other computer.P" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "No username entered0A password cannot be entered without a username." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Remember my password" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Windows Media Center is unable to connect to the internet. Please check your username and password for your default Internet connection.%0" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Windows Update was unable to connect to proxy server %1 because valid credentials (user name and password) were required, but were either not available or were incorrect. Please check your proxy credentials, and then try searching again for updates." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Ask for password (NTLM)P" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "You have chosen to make this site available offline and add it to your Active Desktop interface. If this site needs a password, please choose Customize and enter it." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Type your user name and password for this site." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "If the site requires a user name and password:" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "This channel requires a user name and password before you can download its content. You should have received this information from the content provider." (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "&Yes, my user name and password are:" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp") Found string "Does this site require a password?" (Indicator: "password"; Source: "00000000-00001716.00000001.70425.02C80000.00000002.mdmp")6f:T75e,"%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Vault" (Indicator: "\microsoft\vault"; File: "00000000-00003440-00000C38-15881132887") "%LOCALAPPDATA%\Microsoft\Vault\*" (Indicator: "\microsoft\vault"; File: "00000000-00003440-00000C27-15889450610") "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28" (Indicator: "\microsoft\vault"; File: "00000000-00003440-00000C38-15890498926") "%LOCALAPPDATA%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\*" (Indicator: "\microsoft\vault"; File: "00000000-00003440-00000C27-15892120840") "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\*.*" (Indicator: "\microsoft\vault"; File: "00000000-00003440-00000C27-15894474901") "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Vault\*.*" (Indicator: "\microsoft\vault"; File: "00000000-00003440-00000C27-15897905176") "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00003440-00000C38-31527072383") "%LOCALAPPDATA%\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00003440-00000C27-31528648505") "%TEMP%\grandUIAC8Q0hG4pT4Rhr\Files\AppData\Local\Microsoft\Credentials\*.*" (Indicator: "\microsoft\credentials"; File: "00000000-00003440-00000C27-31530743926") "%TEMP%\grandUIAZ9p4VRlZaB0a6\Files\AppData\Local\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00003352-00000C38-35752326383") "%TEMP%\grandUIAZ9p4VRlZaB0a6\Files\AppData\Local\Microsoft\Vault" (Indicator: "\microsoft\vault"; File: "00000000-00003352-00000C38-37909441991") "%TEMP%\grandUIAZ9p4VRlZaB0a6\Files\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28" (Indicator: "\microsoft\vault"; File: "00000000-00003352-00000C38-37913003069")70:T112f,Found string ".\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00003440-000000D9-34703187") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\5ok1AV0.exe" (Indicator: "\Device\"; Source: "00000000-00001156.00000000.69179.00420000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp, 00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp, 00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp, 00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\6nW2ca8.exe" (Indicator: "\Device\"; Source: "00000000-00001716.00000000.69562.004D0000.00000004.mdmp, 00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000001.70425.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp, 00000000-00002528.00000001.66342.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp, 00000000-00002528.00000001.66342.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp, 00000000-00002528.00000001.66342.00070000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\1eb74op8.exe" (Indicator: "\Device\"; Source: "00000000-00002528.00000000.66162.00070000.00000004.mdmp, 00000000-00002528.00000001.66342.00070000.00000004.mdmp")71:T5f4,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp")72:T1070,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]Version=2AccessCheck=test" (Indicator: "AccessCheck"; File: "gpt.ini") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "5ok1AV0.exe.2503033822") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00001716.00000000.69562.69700000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp")73:T753,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "88f06c42b6a5abb4bca8d456bbdb0b0d.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00001156.00000000.69187.00B61000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001156.00000000.69179.00B87000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001716.00000000.69562.009F7000.00000002.mdmp, 00000000-00001716.00000000.69562.69700000.00000002.mdmp, 00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001716.00000001.70425.00ABC000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002528.00000001.66342.00EB7000.00000002.mdmp, 00000000-00002528.00000001.66342.00EC6000.00000004.mdmp")74:T159a,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 88f06c42b6a5abb4bca8d456bbdb0b0d.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: gG7nW35.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: gG7nW35.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: gG7nW35.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: gG7nW35.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: gG7nW35.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 1eb74op8.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: TI4ji42.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: TI4ji42.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: TI4ji42.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: TI4ji42.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: TI4ji42.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: xu3MF69.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: xu3MF69.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: xu3MF69.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: xu3MF69.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: xu3MF69.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 6nW2ca8.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 6nW2ca8.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 6nW2ca8.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 6nW2ca8.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 6nW2ca8.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 6nW2ca8.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 6nW2ca8.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 6nW2ca8.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 6nW2ca8.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 6nW2ca8.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 6nW2ca8.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 6nW2ca8.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 6nW2ca8.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 6nW2ca8.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 6nW2ca8.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 6nW2ca8.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5ok1AV0.exe]75:T704,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANSERVER\DEFAULTSECURITY"; Key: "SRVSVCDEFAULTSHAREINFO"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "")76:T557,"gG7nW35.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\gG7nW35.exe]- [targetUID: 00000000-00003856] "1eb74op8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1eb74op8.exe]- [targetUID: 00000000-00002528] "TI4ji42.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\TI4ji42.exe]- [targetUID: 00000000-00003268] "4oC416uQ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4oC416uQ.exe]- [targetUID: 00000000-00003352] "xu3MF69.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\xu3MF69.exe]- [targetUID: 00000000-00003676] "6nW2ca8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6nW2ca8.exe]- [targetUID: 00000000-00003856] "5ok1AV0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5ok1AV0.exe]- [targetUID: 00000000-00001156] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00003440] "3OR33jN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3OR33jN.exe]- [targetUID: 00000000-00003364]77:T14a4,Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00003440] Dropped file: "KEDQBKRT.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\KEDQBKRT.htm]- [targetUID: 00000000-00001824] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001824] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002524] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002556] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002524] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00001536] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001536] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00001824] Dropped file: "KPYUNCZF.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\KPYUNCZF.txt]- [targetUID: 00000000-00001824] Dropped file: "QP4MP2L6.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\QP4MP2L6.txt]- [targetUID: 00000000-00001824] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_2DC6057E0FB5565A5F9E9820511707B5]- [targetUID: 00000000-00001536] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317]- [targetUID: 00000000-00001536] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_0E3901F4E624FA7BA72E1374AD94C2CD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_0E3901F4E624FA7BA72E1374AD94C2CD]- [targetUID: 00000000-00002524] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00001824] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00001824] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00001824] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_75B24FDC3C3C4FB8352671805786FA97" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_75B24FDC3C3C4FB8352671805786FA97]- [targetUID: 00000000-00001536] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002524] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_41E82FA0D4E39B947578840880966784" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_41E82FA0D4E39B947578840880966784]- [targetUID: 00000000-00002524] Dropped file: "E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EF]- [targetUID: 00000000-00001536] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002524] Dropped file: "C56CGB2S.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\C56CGB2S.txt]- [targetUID: 00000000-00001824] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00001824] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_0E3901F4E624FA7BA72E1374AD94C2CD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_0E3901F4E624FA7BA72E1374AD94C2CD]- [targetUID: 00000000-00002524]78:Tc007,"initAft()