26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 6b05772e39ea… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6b05772e39ea…. Malware family: Crifi.Generic. Threat score 100/100. 13/26 AV engines flagged this file. 19 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0"],"about":{"@type":"SoftwareApplication","name":"bounty-28643320590983301","applicationCategory":["peexe","executable"],"identifier":"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":13,"total":26},"behavioralIndicators":{"malicious":19,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T782,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308536" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308544" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308572" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308784" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308600" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308756" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308768" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "11205812" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308652" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308748" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "11205808" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308616" - (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindResourceA" with parameter "13308624" - (UID: 00000000-00004152)28:Tcd2,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13355136'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13354992'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13355152'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13355040'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13355008'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13355056'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13355104'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13354976'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13355088'}" (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13355120'}" (UID: 00000000-00004152) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466944'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466800'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466960'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466848'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466816'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466864'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466912'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466784'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466896'}" (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18466928'}" (UID: 00000000-00007036) "te3ZF22.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12437632'}" (UID: 00000000-00002924) "te3ZF22.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12437488'}" (UID: 00000000-00002924) "te3ZF22.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12437648'}" (UID: 00000000-00002924)29:T69c,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp")2a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2b:Ta9f,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006064-14526-254-0127AF88 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006064-14526-254-0127AF88 Assembly shows XOR instruction xor esi dword ptr [01310730h] in Stream UID: 00000000-00006064-14526-334-012601F8 Assembly shows XOR instruction xor esi dword ptr [0131072Ch] in Stream UID: 00000000-00006064-14526-348-012602D6 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00006064-14526-659-0129F7AD Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00006064-14526-816-012506A0 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006064-14526-942-012D4416 Assembly shows XOR instruction xor esi 10h in Stream UID: 00000000-00006064-14526-947-012D3886 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00006064-14526-955-012D30D2 Assembly shows XOR instruction xor eax 08h in Stream UID: 00000000-00006064-14526-1212-012ABF30 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006064-14526-1255-01258891 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00006064-14526-1735-012A6E71 Assembly shows XOR instruction xor byte ptr [ebp+eax-00000120h] 80h in Stream UID: 00000000-00006064-14526-1794-012AAB9C Assembly shows XOR instruction xor al cl in Stream UID: 00000000-00006064-14526-1810-012AAEBA Assembly shows XOR instruction xor byte ptr [ebp-60h] cl in Stream UID: 00000000-00006064-14526-1810-012AAEBA Assembly shows XOR instruction xor byte ptr [ebp-5Fh] cl in Stream UID: 00000000-00006064-14526-1810-012AAEBA Assembly shows XOR instruction xor byte ptr [ebp-000000EFh] cl in Stream UID: 00000000-00006064-14526-1810-012AAEBA Assembly shows XOR instruction xor byte ptr [ebp-000000EEh] cl in Stream UID: 00000000-00006064-14526-1810-012AAEBA Assembly shows XOR instruction xor byte ptr [ebp-000000A5h] cl in Stream UID: 00000000-00006064-14526-1810-012AAEBA Assembly shows XOR instruction xor eax 000087BCh in Stream UID: 00000000-00006064-14526-1895-012B2947 Assembly shows XOR instruction xor eax 0000A685h in Stream UID: 00000000-00006064-14526-1895-012B2947 Assembly shows XOR instruction xor byte ptr [ebx+esi] al in Stream UID: 00000000-00006064-14526-1895-012B2947 Assembly shows XOR instruction xor esi edi in Stream UID: 00000000-00006064-14526-2063-012D7CC2 Assembly shows XOR instruction xor ebx 08000000h in Stream UID: 00000000-00006064-14526-2204-012C2711 Assembly shows XOR instruction xor edi 08000000h in Stream UID: 00000000-00006064-14526-2213-012C2ADE Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006064-14526-2409-012D27822c:T54a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly]2d:T5bf,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00007536-00000C2B-482035157") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00007536-00000C2B-482064937") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00006728-00000C2B-497574363")2e:T20b4,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004152) "rb7ZA41.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007036) "rb7ZA41.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007036) "rb7ZA41.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007036) "te3ZF22.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002924) "te3ZF22.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002924) "te3ZF22.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002924) "2xr5439.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006064) "2xr5439.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000004f03000000000000000001010000ff0700000000000000000000000000000000000000000000e41f0000000000010000000000000001c0d05103c0d051030a00000000000000ff07000000000000c8d05103ff0700000000000000000100feffffff0000000020000000a0f7df007f212701f01551037c15510302000000000000000d00000098f7df00bb2f2701f80d3101d4f7df008e1e2701020000007e1e27014bcbd31f02000000a0c82d010d00000000000000a8f7df003706ed768cf8df00202d260157b63c1efeffffff7e1e27012d1f2701e8f7df0004f8df00ecf7df000200000002000000080000000cf8df00202227010200000004f8df00 (UID: 00000000-00006064) "2xr5439.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006064) "2xr5439.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006064)2f:Td6c,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fbaa00dce38c7230bfb4000000000068fbaa009aac8c7230bfb400c0fbaa00a58f8c7230bfb400010000008746633300000000b216764e000000000300000074fcaa000a000000701e0000b8fcaa00f0fbaa005d0000000300000078fbaa0080fbaa0088feaa00b0bf8c72572c4741feffffffc8fcaa0055118b72b216764e (UID: 00000000-00004152) "rb7ZA41.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f51400dce38c7278ae5a0000000000d8f514009aac8c7278ae5a0030f61400a58f8c7278ae5a0001000000c47b8be5000000004a661c3d0000000003000000e4f614000a0000001416000028f7140060f614005f00000003000000e8f51400f0f51400f8f81400b0bf8c72e41c1197feffffff38f7140055118b724a661c3d (UID: 00000000-00007036) "te3ZF22.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000e38c7268b12c0300000000d0fafe009aac8c7268b12c0328fbfe00a58f8c7268b12c030100000041eae44400000000f4557a440000000003000000dcfbfe000a0000007808000020fcfe0058fbfe005d00000003000000e0fafe00e8fafe00f4fdfe00b0bf8c7279809436feffffff34fcfe0055118b72f4557a4400000000 (UID: 00000000-00002924) "5ik2kS2.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001ea35500739055007cfdbf00a090550030fdbf00c448560012000000acc255000000000010000000c448560012000000acc25500a09c550006000000029e5500060000005a9e550001be550046dd55007cfdbf00219e550088fdbf0078041305c4485600120000000600000045e35500 (UID: 00000000-00007536) "5ik2kS2.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000fdbf003800000000000000000000005e3c3e009f223e007cfdbf00cc223e0030fdbf00608b5000ac0000002c8f3e004000000010000000608b5000ac0000002c8f3e0084333e000e00000042373e000e0000009a373e00018a3e0042e83e007cfdbf0061373e0088fdbf005c044005608b5000ac0000000e00000089ee3e00 (UID: 00000000-00007536) "5ik2kS2.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000004005b11f3e004c274005b0180100000040050040010018f6520054f7000054f70000ed1f3e0000404005000001000cf65200b8203e0090fbbf00f050660000003e0054f7000090fbbf00cb223e007ef35500eff3550000003e00f050660050274005f8fdbf00a8fbbf0000003e000100000000000000a4c4430046020000 (UID: 00000000-00007536) "5ik2kS2.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000005c00000000006300000000000000010000007400140000008858e002000000000100000001000000000000002c000000504fe10200000000140000000a000000000000000000000000006f00b081e00214000000000000000000000000000000000000000000000000006e00000000006700000013000013 (UID: 00000000-00007536) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e00660069006700050000052bdd0000d0047700307d75002e0063006f006e0066006900670000006c006c00 (UID: 00000000-00006728) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000092008000000000000000a11400004cce5d09ee13ee7680000000ee13ee76000000000000000080000000f0625971000000006cce5d0950729476000092000000000080000000f062597102000000002f597188ce5d09fb6259710100000080045a71885f967600000000baf68ed1b8ce5d09b8645971f42e5971 (UID: 00000000-00006728)30:T78f,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "rb7ZA41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "rb7ZA41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "te3ZF22.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "te3ZF22.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2xr5439.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2xr5439.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5ik2kS2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5ik2kS2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")31:T490,"2xr5439.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "2xr5439.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "2xr5439.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "2xr5439.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "2xr5439.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "2xr5439.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "2xr5439.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "2xr5439.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "")32:T1369,"5ik2kS2.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe" at 00000000-00007536-00000C17-487793994 "5ik2kS2.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00007536-00000C17-488650069 "5ik2kS2.exe" queries volume information of "C:\" at 00000000-00007536-00000C17-514885382 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006728-00000C17-493422339 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006728-00000C17-494090024 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006728-00000C17-498705546 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00006728-00000C17-498878699 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00006728-00000C17-498904986 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006728-00000C17-498916509 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006728-00000C17-499003425 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006728-00000C17-499067528 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006728-00000C17-499067781 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00006728-00000C17-500439787 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006728-00000C17-500583775 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006728-00000C17-500602005 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006728-00000C17-500602257 "powershell.exe" queries volume information of "C:\" at 00000000-00006728-00000C17-501905720 "powershell.exe" queries volume information of "C:\share" at 00000000-00006728-00000C17-501907272 "powershell.exe" queries volume information of "C:\share" at 00000000-00006728-00000C17-502042472 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006728-00000C17-504818156 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006728-00000C17-506270661 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006728-00000C17-506459904 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006728-00000C17-506719470 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006728-00000C17-506836974 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00006728-00000C17-50697203233:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")34:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")35:T690d,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004152) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004152) "rb7ZA41.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007036) "rb7ZA41.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007036) "te3ZF22.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002924) "te3ZF22.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002924) "te3ZF22.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002924) "te3ZF22.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002924) "te3ZF22.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002924) "te3ZF22.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002924) "te3ZF22.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002924) "2xr5439.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\2xr5439.exe (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00006064) "2xr5439.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00006064) "5ik2kS2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\5ik2kS2.ENU (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\5ik2kS2.EN (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007536) "5ik2kS2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007536) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006728) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005664) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005664) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005664) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005664) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005664) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003268) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003268) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007140) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007140) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007140) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007140) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007140) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007140) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007140) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003800) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003800) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003800) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003800) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003800) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005284) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005284) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008012) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008012) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008012) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008012) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006884) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006884) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006884) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006884) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003540) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003540) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003540) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003540)36:T4d6,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000868.00000000.97514.00450000.00000004.mdmp, 00000000-00000868.00000001.99434.00450000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000868.00000000.97514.00450000.00000004.mdmp, 00000000-00000868.00000001.99434.00450000.00000004.mdmp, 00000000-00000868.00000002.101353.00450000.00000004.mdmp")37:T11bce,Found reference to API (Indicator: "OpenProcessToken"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegCreateKeyExA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetTokenInformation"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegSetValueExA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EqualSid"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegDeleteValueA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegQueryValueExA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegOpenKeyExA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FreeSid"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegCloseKey"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDeviceCaps"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetVersionExA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WaitForSingleObject"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CompareStringA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LockResource"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GlobalAlloc"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetVersion"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetFileAttributesA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetTempPathA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetStartupInfoW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FormatMessageA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetVolumeInformationA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ResetEvent"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateThread"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFileAttributesA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCurrentProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DeleteFileA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateMutexA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindClose"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateDirectoryA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ReadFile"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "Sleep"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindNextFileA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadResource"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GlobalUnlock"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSystemInfo"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindResourceA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "MulDiv"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindFirstFileA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadLibraryExA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetShortPathNameA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCurrentProcessId"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateFileA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WriteFile"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LocalAlloc"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GlobalFree"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetLastError"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetFileTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CloseHandle"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TerminateThread"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FreeResource"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SizeofResource"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetExitCodeProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LocalFree"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCurrentThreadId"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetProcAddress"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TerminateProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RemoveDirectoryA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadLibraryA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetEvent"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FreeLibrary"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ExitProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GlobalLock"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateEventA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDriveTypeA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateProcessA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetTempFileNameA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetModuleFileNameA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetModuleHandleW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetFilePointer"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetTickCount"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "lstrcmpA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ReleaseDC"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DispatchMessageA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CharUpperA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CallWindowProcA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetWindowPos"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetWindowTextA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ShowWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadStringA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CharPrevA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSystemMetrics"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetWindowLongA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SendMessageA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "MessageBoxA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "MessageBeep"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ExitWindowsEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetForegroundWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDC"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EnableWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetWindowLongA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDesktopWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CharNextA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "PeekMessageA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetWindowRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VerQueryValueA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CheckTokenMembership"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HeapSetInformation"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DecryptFileA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SHBrowseForFolder"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateFontA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetModuleHandleA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SysFreeString"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ShellExecuteA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegSetValueExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "AddAce"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegEnumKeyExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LogonUserW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateProcessWithLogonW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegQueryValueExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetAce"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CopySid"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegEnumValueW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegDeleteValueW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetLengthSid"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegConnectRegistryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetAclInformation"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetUserNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OpenThreadToken"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegCreateKeyExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegOpenKeyExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegDeleteKeyW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InitializeAcl"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DuplicateTokenEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetOpenFileNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSaveFileNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateCompatibleDC"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DeleteDC"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SelectObject"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateSolidBrush"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetObjectW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RoundRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDIBits"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetStockObject"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "StretchBlt"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DeleteObject"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IcmpSendEcho"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "lstrcmpiW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetFileAttributesW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "lstrlenW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VirtualAlloc"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DuplicateHandle"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetStringTypeW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CopyFileExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetEndOfFile"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindResourceExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDriveTypeW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DeviceIoControl"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetErrorMode"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetShortPathNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetTimeFormatW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TlsFree"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DecodePointer"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFileType"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RtlUnwind"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VirtualAllocEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetSystemPowerState"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindFirstFileW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFullPathNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "Process32NextW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateFileW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RaiseException"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateEventW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetProcessHeap"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FlushFileBuffers"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadLibraryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetOEMCP"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetPriorityClass"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetFilePointerEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ExitThread"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetStdHandle"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WriteConsoleW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TlsSetValue"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FormatMessageW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ReadProcessMemory"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EnterCriticalSection"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCPInfo"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetConsoleCP"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EncodePointer"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ResumeThread"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFileAttributesW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HeapFree"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateHardLinkW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindFirstFileExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetVolumeInformationW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InitializeSListHead"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VirtualFree"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateDirectoryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetVersionExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetConsoleMode"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsWow64Process"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetComputerNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CompareStringW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RemoveDirectoryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OutputDebugStringW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InterlockedDecrement"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "Process32FirstW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HeapReAlloc"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetTempPathW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCommandLineW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetProcessIoCounters"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TlsAlloc"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetLongPathNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "lstrcpyW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetProcessId"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateProcessW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetDateFormatW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetVolumeLabelW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCommandLineA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetTempFileNameW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InterlockedExchange"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OpenProcess"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TlsGetValue"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WriteProcessMemory"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreatePipe"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DeleteFileW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HeapSize"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CopyFileW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetLocalTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsValidCodePage"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetStdHandle"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadLibraryExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetACP"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetPrivateProfileSectionW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VirtualFreeEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WritePrivateProfileSectionW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "MoveFileW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetLastError"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindNextFileW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ReadConsoleW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InterlockedIncrement"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HeapAlloc"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LCMapStringW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFileSize"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCurrentThread"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WNetAddConnection2W"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WNetCancelConnection2W"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WNetUseConnectionW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WNetGetConnectionW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VariantInit"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VariantCopyInd"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VariantChangeType"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VariantClear"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SysStringLen"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VariantCopy"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SysAllocString"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SafeArrayAccessData"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ShellExecuteExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SHFileOperationW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SHGetDesktopFolder"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ShellExecuteW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SHGetFolderPathW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadIconW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetKeyboardState"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreatePopupMenu"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetWindowTextW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DrawFrameControl"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadStringW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DispatchMessageW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CharNextW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsCharAlphaNumericW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EnumChildWindows"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CheckMenuRadioItem"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ReleaseCapture"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "UnregisterHotKey"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSubMenu"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetActiveWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsCharUpperW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FillRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSysColorBrush"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DefWindowProcW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCursorPos"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DrawFocusRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsCharAlphaW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetCapture"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "PeekMessageW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ClientToScreen"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsWindowVisible"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "PostQuitMessage"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CloseWindowStation"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ScreenToClient"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "MoveWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CharLowerBuffW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CloseDesktop"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetWindowDC"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateMenu"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EnumWindows"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DestroyIcon"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "PtInRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RedrawWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetWindowTextW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFocus"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSysColor"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InflateRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OpenWindowStationW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateWindowExW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetCursor"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetAsyncKeyState"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "AttachThreadInput"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCaretPos"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetClipboardData"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InsertMenuItemW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EnumThreadWindows"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InvalidateRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FrameRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CountClipboardFormats"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SystemParametersInfoW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetMenuStringW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "BeginPaint"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetClipboardData"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsIconic"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "KillTimer"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetMenu"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OpenClipboard"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "wsprintfW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CopyRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EmptyClipboard"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetParent"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetKeyState"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CloseClipboard"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OpenDesktopW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "TranslateMessage"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadImageW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetTimer"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "MessageBoxW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsZoomed"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DestroyMenu"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SendInput"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetMenuItemID"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCursorInfo"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CopyImage"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DrawMenuBar"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetMenu"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetProcessWindowStation"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DestroyWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegisterHotKey"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetClientRect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetActiveWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetForegroundWindow"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetFocus"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetProcessWindowStation"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LoadCursorW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetMenuItemCount"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CharUpperBuffW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IsWindowEnabled"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DeleteMenu"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetMenuDefaultItem"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VerQueryValueW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetOpenUrlW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetConnectW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HttpQueryInfoW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HttpOpenRequestW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetCloseHandle"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetReadFile"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetSetOptionW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetQueryOptionW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HttpSendRequestW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FtpOpenFileW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetOpenW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FtpGetFileSize"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InternetCrackUrlW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "closesocket"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ioctlsocket"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ntohs"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WSAGetLastError"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WSAStartup"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "inet_addr"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "__WSAFDIsSet"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "WSACleanup"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "htons"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "gethostname"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "recvfrom"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "gethostbyname"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "inet_ntoa"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "IIDFromString"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OleInitialize"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CoGetObject"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "StringFromGUID2"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CoInitialize"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OleSetMenuDescriptor"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CoCreateInstance"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CLSIDFromString"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CoUninitialize"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OleUninitialize"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CoTaskMemFree"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CoInitializeSecurity"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "RegisterEventSourceW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "LCMapStringA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "HeapCreate"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateFileMappingA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "EnumDateFormatsExA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetVolumePathNameA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetLocaleInfoA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetStringTypeA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindFirstVolumeMountPointW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GlobalAddAtomW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "VirtualProtect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetHandleCount"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OpenSemaphoreW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GlobalFindAtomW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindFirstChangeNotificationA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetStartupInfoA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetComputerNameA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "OpenMutexA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetProcessHeaps"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "BackupSeek"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetCurrencyFormatW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindAtomW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "SetComputerNameA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateFileMappingW"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "BeginUpdateResourceA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "BackupWrite"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "CreateJobObjectA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "00000000-00006064.00000000.94988.01241000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount64"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentHwProfileA"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "CredEnumerateA"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "PathAppend"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "FindResource"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "CredFree"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandle"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "PathCombine"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "PathIsRelative"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "RtlUnicodeStringToAnsiString"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "GetTempPath"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetail"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "RtlGetVersion"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "CreateProcess"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevs"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "NtDuplicateObject"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "NtQueryObject"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "CreateEvent"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "LoadLibrary"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00007536.00000000.95409.00312000.00000040.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp")38:T7e8,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0 "DSystem\CurrentControlSet\Control\Session Manager" in Source: 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0 "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0 "System\CurrentControlSet\Control\Session Manager" in Source: 11733-17-0040256D "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 14526-329-0125CF92 "Software\AutoIt v3\AutoIt" in Source: 14526-1225-0124344D "SOFTWARE\Classes\" in Source: 14526-1601-012A06DE "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 26402-159-0136D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 26402-194-01368190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 26402-194-01368190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 26402-194-01368190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 26402-196-0136BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 26402-207-01368AF0 "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000868.00000001.99434.00450000.00000004.mdmp 00000000-00000868.00000002.101353.00450000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000868.00000001.99434.00450000.00000004.mdmp 00000000-00000868.00000002.101353.00450000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000868.00000002.101353.06D62000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000868.00000002.101353.06D62000.00000004.mdmp39:T181e,"2xr5439.exe" failed to load missing module "%WINDIR%\System32\Windows.UI.AppDefaults.dll" - [base:0; Status:ffffffffc0000135] "5ik2kS2.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "5ik2kS2.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "5ik2kS2.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "5ik2kS2.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "5ik2kS2.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "5ik2kS2.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "5ik2kS2.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:ffffffffc0000135]3a:T5334,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76400000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76400000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76400000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "KERNEL32" at base 74a30000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727d0000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "KERNEL32.DLL" at base 74a30000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 749b0000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "FECLIENT.DLL" at base 72790000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72760000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "NTDLL.DLL" at base 76ea0000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "rb7ZA41.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76400000 "rb7ZA41.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76400000 "rb7ZA41.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76400000 "rb7ZA41.exe" loaded module "KERNEL32" at base 74a30000 "rb7ZA41.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727d0000 "rb7ZA41.exe" loaded module "KERNEL32.DLL" at base 74a30000 "rb7ZA41.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 749b0000 "rb7ZA41.exe" loaded module "FECLIENT.DLL" at base 72790000 "rb7ZA41.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72760000 "rb7ZA41.exe" loaded module "NTDLL.DLL" at base 76ea0000 "rb7ZA41.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "te3ZF22.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76400000 "te3ZF22.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76400000 "te3ZF22.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76400000 "te3ZF22.exe" loaded module "KERNEL32" at base 74a30000 "te3ZF22.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727d0000 "te3ZF22.exe" loaded module "KERNEL32.DLL" at base 74a30000 "te3ZF22.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 749b0000 "te3ZF22.exe" loaded module "FECLIENT.DLL" at base 72790000 "te3ZF22.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72760000 "te3ZF22.exe" loaded module "NTDLL.DLL" at base 76ea0000 "te3ZF22.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "2xr5439.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76400000 "2xr5439.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76400000 "2xr5439.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76400000 "2xr5439.exe" loaded module "KERNEL32" at base 74a30000 "2xr5439.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727d0000 "2xr5439.exe" loaded module "KERNEL32.DLL" at base 74a30000 "2xr5439.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73370000 "2xr5439.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76400000 "2xr5439.exe" loaded module "COMCTL32.DLL" at base 72920000 "2xr5439.exe" loaded module "COMCTL32" at base 72920000 "2xr5439.exe" loaded module "RPCRT4.DLL" at base 73940000 "2xr5439.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72140000 "2xr5439.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74a30000 "2xr5439.exe" loaded module "USER32.DLL" at base 76ca0000 "2xr5439.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 72120000 "2xr5439.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 715b0000 "2xr5439.exe" loaded module "PROPSYS.DLL" at base 72e10000 "2xr5439.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72e10000 "2xr5439.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74280000 "2xr5439.exe" loaded module "SECUR32.DLL" at base 71520000 "2xr5439.exe" loaded module "SSPICLI.DLL" at base 738c0000 "2xr5439.exe" loaded module "MLANG.DLL" at base 71020000 "2xr5439.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 74b90000 "2xr5439.exe" loaded module "WININET.DLL" at base 72490000 "2xr5439.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "2xr5439.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73ae0000 "2xr5439.exe" loaded module "NTDLL.DLL" at base 76ea0000 "2xr5439.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "2xr5439.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 71060000 "2xr5439.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 76ad0000 "5ik2kS2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76400000 "5ik2kS2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76400000 "5ik2kS2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76400000 "5ik2kS2.exe" loaded module "KERNEL32" at base 74a30000 "5ik2kS2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727d0000 "5ik2kS2.exe" loaded module "IMM32.DLL" at base 74520000 "5ik2kS2.exe" loaded module "COMCTL32.DLL" at base 726a0000 "5ik2kS2.exe" loaded module "SHFOLDER.DLL" at base 72690000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73370000 "5ik2kS2.exe" loaded module "KERNEL32.DLL" at base 74a30000 "5ik2kS2.exe" loaded module "RPCRT4.DLL" at base 73940000 "5ik2kS2.exe" loaded module "SSPICLI.DLL" at base 738c0000 "5ik2kS2.exe" loaded module "ADVAPI32.DLL" at base 749b0000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72600000 "5ik2kS2.exe" loaded module "SHLWAPI.DLL" at base 75f60000 "5ik2kS2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76ad0000 "5ik2kS2.exe" loaded module "VERSION.DLL" at base 735f0000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71e50000 "5ik2kS2.exe" loaded module "USER32.DLL" at base 76ca0000 "5ik2kS2.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76400000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "5ik2kS2.exe" loaded module "MSCOREE.DLL" at base 72730000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74280000 "5ik2kS2.exe" loaded module "PSAPI.DLL" at base 76a60000 "5ik2kS2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fc50000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "5ik2kS2.exe" loaded module "OLE32.DLL" at base 748b0000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "5ik2kS2.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74280000 "5ik2kS2.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76400000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71cf0000 "5ik2kS2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f1f0000 "5ik2kS2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6e9d0000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "5ik2kS2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71be0000 "5ik2kS2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e250000 "5ik2kS2.exe" loaded module "NTDLL.DLL" at base 76ea0000 "5ik2kS2.exe" loaded module "SHELL32.DLL" at base 74c20000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "5ik2kS2.exe" loaded module "BCRYPT.DLL" at base 72c40000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71bb0000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "5ik2kS2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73810000 "5ik2kS2.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "5ik2kS2.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6d840000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73ae0000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72e10000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 71620000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74c20000 "5ik2kS2.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74a30000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 731b0000 "5ik2kS2.exe" loaded module "MSISO.DLL" at base 6e0a0000 "5ik2kS2.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76400000 "5ik2kS2.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 73ae0000 "5ik2kS2.exe" loaded module "CSCAPI.DLL" at base 72c30000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76400000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76400000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76400000 "powershell.exe" loaded module "KERNEL32" at base 74a30000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727d0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 749b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72600000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75f60000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76ad0000 "powershell.exe" loaded module "VERSION.DLL" at base 735f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71e50000 "powershell.exe" loaded module "USER32.DLL" at base 76ca0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 72730000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74280000 "powershell.exe" loaded module "PSAPI.DLL" at base 76a60000 "powershell.exe" loaded module "RPCRT4.DLL" at base 73940000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74a30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fc50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 748b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 769c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71bb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 738e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71cf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f1f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6e9d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 74280000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 74280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 76ea0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 74c20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e250000 "powershell.exe" loaded module "WINTRUST.DLL" at base 76750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76ae0000 "powershell.exe" loaded module "AMSI.DLL" at base 71b80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 735f0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 71b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 71a90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 76ae0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 71730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 74280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 716e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71be0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 716d0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 738c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 716b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73370000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 71610000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74a30000 "powershell.exe" loaded module "USERENV.DLL" at base 71b50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 749b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 715b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 71590000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74a30000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 71560000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 71550000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71520000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 71520000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 731b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76400000 "powershell.exe" loaded module "MSISO.DLL" at base 6e0a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6dff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 72c40000 "powershell.exe" loaded module "OLEAUT32" at base 769c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 76400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 76900000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 71500000 "powershell.exe" loaded module "MI.DLL" at base 6dd00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 76400000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6dc70000 "powershell.exe" loaded module "GDI32.DLL" at base 76c70000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76400000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6dc60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6dbe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6db20000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76400000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 74a30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 76400000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76400000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76400000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76400000 "cmd.exe" loaded module "KERNEL32" at base 74a30000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727d00003b:T4a4,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 738E0000 "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C40000 "rb7ZA41.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 738E0000 "rb7ZA41.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C40000 "te3ZF22.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 738E0000 "te3ZF22.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C40000 "2xr5439.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 738E0000 "2xr5439.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C40000 "5ik2kS2.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 738E0000 "5ik2kS2.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C40000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 738E0000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C40000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 738E0000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72C400003c:Tb46,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0" was detected as "Microsoft Cabinet" and name: "sfx" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0" was detected as "Microsoft Cabinet File" and name: "Archive" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0" was detected as "Microsoft Linker" and name: "Linker" "rb7ZA41.exe" was detected as "Microsoft Cabinet" and name: "sfx" "rb7ZA41.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "rb7ZA41.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "rb7ZA41.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "rb7ZA41.exe" was detected as "Microsoft Linker" and name: "Linker" "te3ZF22.exe" was detected as "Microsoft Cabinet" and name: "sfx" "te3ZF22.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "te3ZF22.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "te3ZF22.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "te3ZF22.exe" was detected as "Microsoft Linker" and name: "Linker" "5ik2kS2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5ik2kS2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5ik2kS2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5ik2kS2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5ik2kS2.exe" was detected as "Microsoft Linker" and name: "Linker" "2xr5439.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2xr5439.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2xr5439.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2xr5439.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2xr5439.exe" was detected as "Microsoft Linker" and name: "Linker" "6Mb3Ab2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6Mb3Ab2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6Mb3Ab2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6Mb3Ab2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6Mb3Ab2.exe" was detected as "Microsoft Linker" and name: "Linker" "7MJ8gW89.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7MJ8gW89.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7MJ8gW89.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7MJ8gW89.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7MJ8gW89.exe" was detected as "Microsoft Linker" and name: "Linker"3d:T488,Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Indicator: "Write-Error"; Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found string "foreach($resolvedPath in (Resolve-Path @PSBoundParameters))" (Indicator: "Resolve-Path"; Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp")3e:T19fa,"2xr5439.exe" touched "Internet Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "2xr5439.exe" touched "Property System Both Class Factory" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "2xr5439.exe" touched "File Property Page Extension" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}") "2xr5439.exe" touched "Microsoft Url History Service" (Path: "HKCU\WOW6432NODE\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "2xr5439.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "2xr5439.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "2xr5439.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "5ik2kS2.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "5ik2kS2.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "5ik2kS2.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5ik2kS2.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "5ik2kS2.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "5ik2kS2.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "5ik2kS2.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "5ik2kS2.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "5ik2kS2.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "5ik2kS2.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "5ik2kS2.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "5ik2kS2.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "5ik2kS2.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "5ik2kS2.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "5ik2kS2.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "5ik2kS2.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "5ik2kS2.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "5ik2kS2.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "5ik2kS2.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "5ik2kS2.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "5ik2kS2.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "5ik2kS2.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "5ik2kS2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "5ik2kS2.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "5ik2kS2.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "5ik2kS2.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "5ik2kS2.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "5ik2kS2.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "5ik2kS2.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "5ik2kS2.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "5ik2kS2.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5ik2kS2.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")3f:T104e,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "rb7ZA41.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "te3ZF22.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5ik2kS2.exe" file has an entrypoint instructions - "jmp 0x85c44e,add byte ptr [eax + ecx], dl,add byte ptr [eax], al,add byte ptr [eax], al,pushal ,call 0x85c454,pop ebp,sub ebp, 0x10,sub ebp, 0x45c444,jmp 0x85c46a,out 0x70, al,jecxz 0x85c4a7,mov eax, 0x45c444,add eax, ebp,add eax, 0x4c,mov ecx, 0x5f2,mov edx, 0x7405a294,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0x85c481,jmp 0x85c494,pop ss,les esi, ptr [esi + ebp*4 + 0x1f],pop ecx,pop ds,sbb eax, 0x949494a8,adc eax, 0x94946c55,xchg esp, eax,xchg edi, eax,pop ecx,sub al, 0x90,xchg esp, eax,xchg esp, eax," "2xr5439.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "6Mb3Ab2.exe" file has an entrypoint instructions - "call 0x405a69,jmp 0x401f8b,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edx, dword ptr [esp + 0xc],mov ecx, dword ptr [esp + 4],test edx, edx,je 0x402195,xor eax, eax,mov al, byte ptr [esp + 8],test al, al,jne 0x40214c,cmp edx, 0x100,jb 0x40214c,cmp dword ptr [0x870088], 0,je 0x40214c,jmp 0x405b56,push edi,mov edi, ecx,cmp edx, 4,jb 0x402185,neg ecx,and ecx, 3,je 0x402167,sub edx, ecx,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,jne 0x40215d,mov ecx, eax,shl eax, 8," "7MJ8gW89.exe" file has an entrypoint instructions - "call 0x4031a7,jne 0x4031af,je 0x4031af,jnp 0x403153,and dword ptr [ecx - 0x74fb3b7d], ecx,pop esp,and al, 0xfc,jmp 0x4031c2,add al, 0x81,jmp 0x403163,xor dword ptr [eax], eax,add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xb1d340c7,rol bh, 1,inc esp,and al, 0xfc,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x4031e2,je 0x4031e2,int3 ,dec esi,xchg esi, eax,add eax, dword ptr [ebx + 0x548b04c4],and al, 0xfc,jmp 0x4031f1,add al, 0x29,shr bl, 5,add ch, bl,stc ,add al, 2,jmp 0x4031fc,or byte ptr [edx], cl,loop 0x403246,mov byte ptr [ebx + eax + 2], ah,je 0x403206,jne 0x403206,mov cl, 0xb5,dec edi,"40:T277f,Process "rb7ZA41.exe" (UID: 00000000-00007036) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "rb7ZA41.exe" (UID: 00000000-00007036) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00005012) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00005012) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00001320) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_5012_RGRAZJGGLFUUAZSD", EDGE_BROWSER_PID="5012"" Process "msedge.exe" (UID: 00000000-00001320) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00001320) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007848) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007848) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007848) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004268) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004268) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00004300) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_5012_RGRAZJGGLFUUAZSD", EDGE_BROWSER_PID="5012", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00004300) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00004300) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007248) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00005024) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00005024) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007408) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007408) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00007408) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00008060) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_5012_RGRAZJGGLFUUAZSD", EDGE_BROWSER_PID="5012", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00008060) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00008060) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "5ik2kS2.exe" (UID: 00000000-00007536) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "5ik2kS2.exe" (UID: 00000000-00007536) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "5ik2kS2.exe" (UID: 00000000-00007536) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_BROWSER_PID, FPS_BROWSER_APP_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00001148) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_5012_RGRAZJGGLFUUAZSD", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_BROWSER_PID="5012", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00001148) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "msedge.exe" (UID: 00000000-00001148) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007328) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007328) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00000400) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00000400) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "powershell.exe" (UID: 00000000-00006728) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00006728) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "powershell.exe" (UID: 00000000-00006728) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_BROWSER_PID, FPS_BROWSER_APP_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006984) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_5012_RGRAZJGGLFUUAZSD", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_BROWSER_PID="5012", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00006984) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "msedge.exe" (UID: 00000000-00006984) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "powershell.exe" (UID: 00000000-00005664) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00005664) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "powershell.exe" (UID: 00000000-00005664) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_BROWSER_PID, FPS_BROWSER_APP_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00005208) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="29", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_5012_RGRAZJGGLFUUAZSD", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_BROWSER_PID="5012", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", EDGE_VARIATIONS_SEED_ETAG=""uiIxlFHEqYK/kbVuiEU5CgZajeU9QmL4/F97KjHfTZw="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00005208) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "msedge.exe" (UID: 00000000-00005208) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"41:T75e,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "rb7ZA41.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "rb7ZA41.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "rb7ZA41.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "te3ZF22.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "te3ZF22.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "te3ZF22.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2xr5439.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "2xr5439.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2xr5439.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2xr5439.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "5ik2kS2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "5ik2kS2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5ik2kS2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5ik2kS2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")42:Tf87,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004152-00000C2A-471682855] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004152-00000C2A-471836036] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004152-00000BC1-471870950] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00007036-00000BC1-472748801] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002924-00000BC1-473762119] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007536-00000C2A-485373421] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007536-00000C2A-486709231] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007536-00000C2A-487125369] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007536-00000C2A-487308292] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007536-00000C2A-487741175] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007536-00000C2A-487802931] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007536-00000C2A-487892407] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007536-00000C2A-488013779] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007536-00000C2A-488212542] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007536-00000C2A-488595229] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007536-00000C2A-488679766] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00007536-00000C2A-489086456] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00007536-00000C2A-489175978] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007536-00000C2A-489421164] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007536-00000C2A-489645405] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007536-00000C2A-512367143] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006728-00000C2A-493311389] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006728-00000C2A-494024751] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006728-00000C2A-494508061] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006728-00000C2A-494763570]43:Tc37,Spawned process "rb7ZA41.exe" (UID: 00000000-00007036) Spawned process "te3ZF22.exe" (UID: 00000000-00002924) Spawned process "2xr5439.exe" (UID: 00000000-00006064) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00005012) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001320), Spawned process "msedge.exe" with commandline "--single-argument https://facebook.com/login" (UID: 00000000-00007848), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004268) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00004300) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007248) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005024) Spawned process "msedge.exe" with commandline "--single-argument https://www.youtube.com/" (UID: 00000000-00007408) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00008060) Spawned process "5ik2kS2.exe" (UID: 00000000-00007536) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00001148) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00005692) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007328), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00000400), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003756), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007048), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00004788), Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00006728), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00006984), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00003596), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007272), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00001324)44:Tc37,Spawned process "rb7ZA41.exe" (UID: 00000000-00007036) Spawned process "te3ZF22.exe" (UID: 00000000-00002924) Spawned process "2xr5439.exe" (UID: 00000000-00006064) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00005012) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001320), Spawned process "msedge.exe" with commandline "--single-argument https://facebook.com/login" (UID: 00000000-00007848), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004268) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00004300) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007248) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005024) Spawned process "msedge.exe" with commandline "--single-argument https://www.youtube.com/" (UID: 00000000-00007408) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00008060) Spawned process "5ik2kS2.exe" (UID: 00000000-00007536) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00001148) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00005692) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007328), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00000400), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003756), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007048), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00004788), Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00006728), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00006984), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00003596), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007272), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00001324)45:T836,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: B1:06:D8:49:F1:03:BE:43:D7:79:D9:25:25:FE:92:54:6C:93:0B:54; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DA:54:10:25:B5:61:AE:60:C1:81:8B:6B:29:79:A3:8E:E8:1B:D4:35; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A0:31:C4:67:82:E6:E6:C6:62:C2:C8:7C:76:DA:9A:A6:2C:CA:BD:8E; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 1C:09:46:89:AD:F3:B6:3E:B4:89:F7:49:AC:15:E7:4E:A6:D2:AA:73; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 41:FF:72:9C:74:6F:D4:D1:3B:A8:03:EB:55:D2:D2:09:7E:7A:44:DC; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: CB:D6:DD:24:49:A1:05:33:C4:D6:0A:04:6A:88:75:11:64:1B:56:6D; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: BD:9B:9A:98:48:F7:F4:EB:41:6E:44:69:C4:CE:9D:13:6D:6D:CB:53; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 7B:D2:02:FC:58:D9:E6:6C:DB:4E:0A:85:10:91:65:A5:9A:9C:5D:12; see report for more information)46:Tba9,"rb7ZA41.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP000.TMP\rb7ZA41.exe]- [targetUID: 00000000-00004152] "te3ZF22.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP001.TMP\te3ZF22.exe]- [targetUID: 00000000-00002924] "5ik2kS2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\IXP002.TMP\5ik2kS2.exe]- [targetUID: 00000000-00002924] "urlref_httpsaccounts.google.com" has type "HTML document ASCII text with very long lines (57301)"- [targetUID: N/A] "2xr5439.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP002.TMP\2xr5439.exe]- [targetUID: 00000000-00006064] "urlref_httpswww.youtube.com" has type "HTML document ASCII text with very long lines (55474)"- [targetUID: N/A] "6Mb3Ab2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\IXP001.TMP\6Mb3Ab2.exe]- [targetUID: 00000000-00007036] "7MJ8gW89.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7MJ8gW89.exe]- [targetUID: 00000000-00004152] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006728] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Unicoded MachineID ij7vfnkfrqwrim5 KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Mon Jun 2 16:06:10 2025 atime=Mon Jun 2 16:06:10 2025 mtime=Tue Jan 2 03:16:40 2024 length=1527296 window=normal IDListSize 0x0230 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Temp\FANBooster131\FANBooster131.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00007536] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00006728] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006728] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- [targetUID: N/A] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00007536] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00007536] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00007536]47:T7aa,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")48:Tf15,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "6B05772E39EA7AE4C3396FBEDC1E5A462DB3CD611BE8548F452B2EC19F1581C0.EXE"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")49:T518,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"4a:Tbc2,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\CABINET.DLL" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\VERSION.DLL" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RB7ZA41.EXE" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\rb7ZA41.exe" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7MJ8GW89.EXE" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7MJ8gW89.exe" "rb7ZA41.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\TE3ZF22.EXE" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\te3ZF22.exe" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6MB3AB2.EXE" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Mb3Ab2.exe" "te3ZF22.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\2XR5439.EXE" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\2xr5439.exe" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5IK2KS2.EXE" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe" "2xr5439.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"4b:T5af,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\6B05772E39EA7AE4C3396FBEDC1E5A462DB3CD611BE8548F452B2EC19F1581C0.EXE.LOCAL" "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RB7ZA41.EXE.LOCAL" "rb7ZA41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\TE3ZF22.EXE.LOCAL" "te3ZF22.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "2xr5439.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\2XR5439.EXE.LOCAL" "2xr5439.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "2xr5439.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\2xr5439.exe.Local\" "5ik2kS2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5IK2KS2.EXE.LOCAL" "5ik2kS2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe.Local\" "5ik2kS2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5IK2KS2.ENU"4c:T487,Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0")4d:T46a,"0.0.0.0" "255.255.255.255" "1.0.0.0" "2.5.29.37" "2.5.29.35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "192.168.0.2" Potential IP "4.0.0.0" found in string "ystem.Data.SqlXml,4.0.0.0,,b77a5c561934e089,MSIL" "2.5.29.32" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.4.3" "2.5.29.14" "2.5.29.15" "2.5.29.19" "2.5.29.17" "2.5.29.1" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" "2.5.29.10" "2.5.29.16" "2.5.4.8" "2.5.4.7" "2.5.4.5" "2.5.4.11" "2.5.4.10" "2.5.4.6" Potential IP "1.0.0.0" found in string "anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "ture,1.0.0.0,,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "ndows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" "11.10.3.6" "1.10.3.6" "1.3.6.1"4e:T223b,Pattern match: "www.youtube.com" Pattern match: "https://facebook.com/login" Pattern match: "https://www.youtube.com/" Pattern match: "https://accounts.google.com/" Heuristic match: "bt_.tp" Heuristic match: "lo.ru" Heuristic match: "if.cn" Heuristic match: "=\.tt" Heuristic match: "lf.hu" Heuristic match: "accounts.google.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "googleads.g.doubleclick.net" Heuristic match: "i.ytimg.com" Heuristic match: "play.google.com" Heuristic match: "rr4---sn-q4fl6nsy.googlevideo.com" Heuristic match: "static.doubleclick.net" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Heuristic match: "youtube.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "

http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000868.00000001.99434.006B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000868.00000001.99434.006B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found URL "http://crl.microsoft.com/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-0ya'4>@6t+a6" - Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000868.00000001.99434.06D62000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000868.00000002.101353.00450000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00000868.00000002.101353.083C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000868.00000002.101353.083C0000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00000868.00000002.101353.083C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00000868.00000002.101353.083C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000868.00000002.101353.083C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000868.00000002.101353.083C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0at-kt20170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00000868.00000002.101353.083C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000868.00000002.101353.085C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000868.00000002.101353.085C0000.00000004.mdmp") Found URL "http://www.microkvrzw08vvp8vv'vv" - Source: "00000000-00000868.00000002.101353.085C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00000868.00000002.101353.085C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-0uya'4>@6t+a6" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>i" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=828955'" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=829061'" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=393271'qzfcl&*h$_zu" - Source: "00000000-00003268.00000002.101349.07462000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003268.00000002.101349.08AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003268.00000002.101349.08AF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003268.00000002.101349.08AF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003268.00000002.101349.08AF0000.00000004.mdmp") Found URL "http://croft.com/pki/crl//microsofttimestrl0xhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linki:" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0]db" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@washington1redmond1microsoft" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00003268.00000002.101349.09170000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003800.00000000.97524.00F70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003800.00000001.99443.00F70000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%y" - Source: "00000000-00003800.00000001.99443.07552000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003800.00000002.101363.00F70000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ypenucri1.3.132.0.35@eckp" - Source: "00000000-00003800.00000002.101363.07552000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003800.00000002.101363.07552000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003800.00000002.101363.07552000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>2.5.2.5.4.3wvtasn1spcminimalcriteriainfodecode1.3.6.1.4.1.311.12.2.31.3.6.1.4.1.311.10.3.6qmani" - Source: "00000000-00003800.00000002.101363.07552000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00003800.00000002.101363.07552000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003800.00000002.101363.07552000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0washington1redmond1microsoft" - Source: "00000000-00003800.00000002.101363.07552000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0om8m6sp%%'q%kfp" - Source: "00000000-00003800.00000002.101363.07552000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "http://www.microm" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1jubl20170929084817.684z0washington1redmond1microsoft" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "http://pesterbdd.com/images/pester.png" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "https://github.com/pester/pester" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.html" - Source: "00000000-00003800.00000002.101363.08BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00003800.00000002.101363.08FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003800.00000002.101363.08FA0000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00003800.00000002.101363.08FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00003800.00000002.101363.08FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003800.00000002.101363.08FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0]db" - Source: "00000000-00003800.00000002.101363.08FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003800.00000002.101363.08FA0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003800.00000002.101363.71A11000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004152.00000000.94806.00B20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004152.00000002.98647.00B20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005284.00000000.97534.01130000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005284.00000001.99454.01130000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005284.00000002.101373.01130000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005284.00000002.101373.07932000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005284.00000002.101373.07932000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00005284.00000002.101373.07932000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0asyc1.3.6.1.4.1.311.10.1createindirectdatacreateindirectdatap7sipcreateindirectdatacreateindirectdataesscontenthintencodeexwvtasn1spclinkencodewvtasn1spcsiginfoencode1.3.6.1.4.1.311.12.2.1essreceiptencodeexessmlhistoryencodeexesdsipcreatehashwvtasn1spclinkencodeuvwvtasn1spclinkencodemsisipcreateindirectdataesskeyexchpreferenceencodeex1.2.840.113549.1.9.16.2.12pvvcryptsipcreateindirectdatacryptsipcreateindirectdatacryptsipcreateindirectdataesssigncertificateencodeex1.2.840.113549.1.9.16.2.2" - Source: "00000000-00005284.00000002.101373.07932000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>3407z20170930113407z0w0=1/0-01(0&0p" - Source: "00000000-00005284.00000002.101373.07932000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00005284.00000002.101373.07932000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://www.microm" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063258.923z0washington1redmond1microsoft" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!washington1redmond1microsoft" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://pesterbdd.com/images" - Source: "00000000-00005284.00000002.101373.08FE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows20170929063258.923z0washington1redmond1microsoft" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0erwd20170929063258.923z0washington1redmond1microsoft" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!washington1redmond1microsoft" - Source: "00000000-00005284.00000002.101373.094D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005664.00000000.97502.00DD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005664.00000001.99421.00DD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005664.00000002.101343.00DD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eyp" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ycp" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01301" - Source: "00000000-00005664.00000002.101343.00EBB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0ycvded/_&" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/ce_erlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+imit/poll&u@t" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0;" - Source: "00000000-00005664.00000002.101343.072E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005664.00000002.101343.08A00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0.tq[m*$" - Source: "00000000-00005664.00000002.101343.08A00000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00005664.00000002.101343.08A00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0com1" - Source: "00000000-00005664.00000002.101343.08A00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0ycvded/_&" - Source: "00000000-00005664.00000002.101343.08A00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/pricrooceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/ceroceraut_2010-06-23.crt01http://www.microsoki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005664.00000002.101343.08A00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005664.00000002.101343.08A00000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportscan" - Source: "00000000-00005664.00000002.101343.08C60000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005664.00000002.101343.08C60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005664.00000002.101343.08C60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005664.00000002.101343.08C60000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00005664.00000002.101343.08C60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0washington1redmond1microsoft" - Source: "00000000-00005664.00000002.101343.08C60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0ycvded/_&" - Source: "00000000-00005664.00000002.101343.08C60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0.tq[m*$" - Source: "00000000-00005664.00000002.101343.08C60000.00000004.mdmp") Found URL "https://www.youtube.com/emdripttps://facebook.com/loginttps://www.youtube.com/ttps://facebook.com/loginicrosoft\windows\inetcachettps://www.youtube.com/2024071520240716:" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "https://accounts.google.com/roperty" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "https://facebook.com/login:\windows\system32\iertutil.dll+ncalrpc:[ole7f5f4785a53e22dd20c928aad914]desktop-fvvf82a192.168.0.22001:0:34f1:8072:841:2c38:3f57:fffddesktop-fvvf82a192.168.0.22001:0:34f1:8072:841:2c38:3f57:fffdf+ncalrpc:[ole40c7ebce82cce555bbeaae170a36]esktop-fvvf82a\hapubwschangebackgroundtaskwindows.backgroundtasksmicrosoft.windoxr5439.exebout:blankbout:blankummy://urlsedgehtmttpspmappere.httpshromehtmlsystem32\clbcatq.dllesktop-fvvf82a\hapubwsps_fastpropertiesonlyesktop-fvvf82a\hapubws:\users\hapubwsntexception145574-clsid\" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "https://www.youtube.com/ubws\appdata\local\temp\ixp002.tmphttps://www.youtube.com/https://www.youtube.com/??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649:\windows\system32\windows.ui.appdefaults.dll:\users\hapubws\appdata\local\temp\ixp002.tmpgram\(x86)=c[gram" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "https://www.youtube.com/https://www.youtube.com/??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649ppx90nv6nhay5n6a98fnetv7tpk64pp35es:\windows\system32\windows.storage.dllxe" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "https://www.youtube.com/:\users\hapubws\appdata\local:\windows\system32\secur32.dllessioninformationwttps://accounts.google.com/tsstartremotecontrolsessionahttps://www.youtube.com/:\windows\system32\edputil.dllicrosoft" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "https://www.youtube.com/icrosoftedge_iecompaticrosoftedge_iecompat::\windows\system32\pcacli.dllsystemroot\winsxs\filemaps\_0000000000000000.cdf-ms??\c:\users\hapubws\appdata\local\temp\ixp002.tmp\?\volume" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "https://accounts.google.com/https://facebook.com/login??\c:\program" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006064.00000000.94988.034F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006728.00000000.96026.00750000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006884.00000000.97546.004E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006884.00000001.99466.004E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006884.00000001.99466.005BD000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006884.00000001.99466.005BD000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006884.00000001.99466.005BD000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006884.00000001.99466.005BD000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc" - Source: "00000000-00006884.00000001.99466.005BD000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006884.00000001.99466.005BD000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006884.00000001.99466.005BD000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006884.00000001.99466.00800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006884.00000001.99466.00800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00006884.00000001.99466.06F80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006884.00000001.99466.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00006884.00000001.99466.06F80000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006884.00000001.99466.06F80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006884.00000001.99466.06F80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006884.00000002.101386.004E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006884.00000002.101386.005BD000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006884.00000002.101386.005BD000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006884.00000002.101386.005BD000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006884.00000002.101386.005BD000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc" - Source: "00000000-00006884.00000002.101386.005BD000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006884.00000002.101386.005BD000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006884.00000002.101386.005BD000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006884.00000002.101386.06F80000.00000004.mdmp") Found URL "http://crl.microsof^k*yencdencdencdncipher" - Source: "00000000-00006884.00000002.101386.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00006884.00000002.101386.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com/windowswashington1redmond1microsoft" - Source: "00000000-00006884.00000002.101386.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006884.00000002.101386.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!qactxlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistpflistlistlistlistlistlistlistlistlistlistlistlist" - Source: "00000000-00006884.00000002.101386.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt06n5\56n5,4x6n5&4b:" - Source: "00000000-00006884.00000002.101386.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt00@0!6n5,xary$xawte," - Source: "00000000-00006884.00000002.101386.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0cros" - Source: "00000000-00006884.00000002.101386.08990000.00000004.mdmp") Found URL "http://crl.m/procrosoftrootcert.micrnm/pki/certs/micrmtcert.crt0washington1redmond1microsoft" - Source: "00000000-00006884.00000002.101386.08990000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00006884.00000002.101386.08990000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006884.00000002.101386.08990000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006884.00000002.101386.08990000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006884.00000002.101386.08990000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007036.00000001.96797.00580000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007036.00000002.98716.00580000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007140.00000000.97518.004A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007140.00000001.99437.004A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007140.00000002.101357.004A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ee>np" - Source: "00000000-00007140.00000002.101357.06E32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00007140.00000002.101357.06E32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>&e?v6t$zpppgase>" - Source: "00000000-00007140.00000002.101357.06E32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00007140.00000002.101357.06E32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007140.00000002.101357.06E32000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=403112" - Source: "00000000-00007140.00000002.101357.06E32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007140.00000002.101357.06E32000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>4j\^c" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.hn\$vkt7" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>i" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0erwd20170929063258.923z0washington1redmond1microsoft" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!washington1redmond1microsoft" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0q/-11o0m0gjk" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0noniclnonicnonicnoniclnonicnoniclnonicnonicnonicnonicnonicnonicnonicnonicv154704027286,6988,6,lpsystemname,0154704027286,6988,3,sid,1,0,,5731a0154704027286,6988,6,name,2,1,0,@968cac8,30,4e004500540057004f0052004b0020005300450052005600490043004500154704027286,6988,6,cchname,3,1,0,@968caa8,4,0f000000154704027286,6988,6,referenceddomainname,4,1,0,@968cb48,24,4e005400200041005500540048004f005200490054005900154704027286,6988,6,cchreferenceddomainname,5,1,0,@968caa4,4,0c000000154704027286,6988,6,peuse,6,1,0,@968caac,4,05000000e>u?" - Source: "00000000-00007140.00000002.101357.08470000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdata" - Source: "00000000-00007140.00000002.101357.086C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007140.00000002.101357.086C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007140.00000002.101357.086C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007140.00000002.101357.086C0000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00007140.00000002.101357.086C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" - Source: "00000000-00007140.00000002.101357.086C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1jubl20170929084817.684z0washington1redmond1microsoft" - Source: "00000000-00007140.00000002.101357.086C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007140.00000002.101357.086C0000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0." - Source: "00000000-00007536.00000000.95409.0067E000.00000040.mdmp") Found URL "http://s.symcd.com06/0-0+%http://s.symcb.com/universal-root.crl0timestamp-2048-30ch9@!xlbnsymantec" - Source: "00000000-00007536.00000000.95409.0067E000.00000040.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0@90705/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0k0i0*http://ts-ocsp.ws.symantec.com0;/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(timestamp-2048-60rpc/u)" - Source: "00000000-00007536.00000000.95409.0067E000.00000040.mdmp") Found URL "http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/latestcrl.crl07+0)0'http://pki-ocsp.symauth.com0*>gf3ul6)sfuk" - Source: "00000000-00007536.00000000.95409.0067E000.00000040.mdmp") Found URL "http://pki-crl.symauth.com/offlineca/theinstituteofelectricalandelectronicsengineersincieeerootca.crl0verisignmpki-2-3990" - Source: "00000000-00007536.00000000.95409.0067E000.00000040.mdmp") Found URL "https://enigmaprotector.com/e-mail" - Source: "00000000-00007536.00000000.95409.0067E000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007536.00000000.95409.02DD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007536.00000001.97330.02DD0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00007536.00000001.97330.06000000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00007536.00000001.97330.06000000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00007536.00000001.97330.06000000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007536.00000001.97330.06000000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007536.00000001.97330.06000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007536.00000002.99250.02DD0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00007536.00000002.99250.06000000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00007536.00000002.99250.06000000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00007536.00000002.99250.06000000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007536.00000002.99250.06000000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007536.00000002.99250.06000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008012.00000000.97539.03490000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008012.00000001.99459.03490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008012.00000001.99459.03579000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008012.00000001.99459.03579000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.cr10/0-!http://ocsp.globalsign.com/rootr1b@dd*v" - Source: "00000000-00008012.00000001.99459.03579000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008012.00000001.99459.03579000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008012.00000001.99459.03579000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008012.00000001.99459.03579000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008012.00000001.99459.03579000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00008012.00000001.99459.03579000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008012.00000001.99459.03660000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00008012.00000001.99459.05320000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfglobalsign" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($n:^tpnew" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%y6n5xsystem6n5udigicert" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.64.1.10c0!0a0!system.security.permissions.permissionsetattribute," - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,e" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crls/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://=osoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010rl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008012.00000001.99459.07AE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008012.00000002.101380.03579000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008012.00000002.101380.03579000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008012.00000002.101380.03579000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008012.00000002.101380.03579000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008012.00000002.101380.03579000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00008012.00000002.101380.03579000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://pesterbdd.com/images/pester.png" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "https://github.com/pester/pester" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.html" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://waeeetqqqqqqqqqqqqqqqqoft" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/procrooceraut_2010-06-23.crl0zn0l0j>http://www.micros20170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microspki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@7" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micti" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstap;-07-01.crt0washington1redmond1microsoft" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0at-kt20170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>zo7p7b" - Source: "00000000-00008012.00000002.101380.08F20000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdefenderpynetdefenderscanthreats18022syste.12.17007.18022ntispywareindefendanagerpengine_inmemoryscan_cachemaxbufferasttesterrorheartbeatreporttimepengine_inmemoryscan_cachemaxbufferastsetuperrorheartbeatreporttimeastsetuperrorheartbeatreporttimepengine_zonebasedurlexclusiondisabledastmapsdisableheartbeatreporttimeastmpsigstuberrorheartbeatreporttimeastmapsdisableheartbeatreporttimeastdefenderdisableheartbeatreporttimeastdefenderdisableheartbeatreporttimee0bd1179-0c47-4871-93e8-a4eb4a556a93" - Source: "00000000-00008012.00000002.101380.093A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows07<" - Source: "00000000-00008012.00000002.101380.093A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008012.00000002.101380.093A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008012.00000002.101380.093A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" - Source: "00000000-00008012.00000002.101380.093A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1r=" - Source: "00000000-00008012.00000002.101380.093A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3532 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 02 Jan 2024 19:01:53 GMT Last-Modified: Tue 02 Jan 2024 18:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 02 Jan 2024 18:42:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1159 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 906 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 02 Jan 2024 19:01:54 GMT Last-Modified: Tue 02 Jan 2024 18:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue, 02 Jan 2024 18:03:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 3533 Cache-Control: max-age=7200 Date: Tue 02 Jan 2024 19:01:54 GMT Last-Modified: Tue 02 Jan 2024 18:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 02 Jan 2024 18:40:53 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1261 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcw2OhODNdUsdsGX9WUu4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 500 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 02 Jan 2024 19:01:56 GMT Last-Modified: Tue 02 Jan 2024 18:53:36 GMT Server: ECAcc (sac/254F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 02 Jan 2024 18:20:18 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2498 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 02 Jan 2024 18:52:49 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 547 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 02 Jan 2024 18:57:16 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 282 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 02 Jan 2024 18:36:26 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1532 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAUov%2BRSzckSEFSlqgvND%2Fg%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5272 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 02 Jan 2024 19:01:59 GMT Last-Modified: Tue 02 Jan 2024 17:34:07 GMT Server: ECAcc (sac/2505) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 02 Jan 2024 18:47:52 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 853 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5173 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 02 Jan 2024 19:02:46 GMT Last-Modified: Tue 02 Jan 2024 17:36:33 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6106 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 02 Jan 2024 19:02:47 GMT Last-Modified: Tue 02 Jan 2024 17:21:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 959 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 02 Jan 2024 19:02:47 GMT Last-Modified: Tue 02 Jan 2024 18:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......6b:T520,Found string "" (Indicator: "text/javascript"; File: "E63JAJVH.htm") Found string "" (Indicator: "text/javascript"; File: "E63JAJVH.htm") Found string "" (Indicator: "text/javascript"; File: "E63JAJVH.htm") Found string "" (Indicator: "text/javascript"; File: "E63JAJVH.htm")6c:Tf0f,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002692.00000A84.567221.00090000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003824-00000C25-41315760] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003824-00000BC1-41327364] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003324-00000BC1-41952346] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002692-00000BC1-42452742] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00002500-00000C25-43509723] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003356-00000C25-49470828] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003356-00000C25-50315982] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003356-00000C25-50452262] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003356-00000C25-50777340] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003356-00000C25-50863688] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003356-00000C25-51045498] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003356-00000C25-51091118] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003356-00000C25-51497838] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003356-00000C25-51627434] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003356-00000C25-51678921] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll" [Source: 00000000-00003356-00000C25-51716540] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003356-00000C25-51906491] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003356-00000C25-51950781] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003356-00000C25-51997099] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003356-00000C25-52163943] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003356-00000C25-52339517] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003356-00000C25-68602105] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00003356-00000C25-71743293] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00003356-00000C25-77683347]6d:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")6e:T8ed,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcw2OhODNdUsdsGX9WUu4%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAUov%2BRSzckSEFSlqgvND%2Fg%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D" Found http requests in header "POST /api" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D"6f:T2d20,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=3.2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-AliveCookie: fr=0QCMrxLLmzhVkejUK..BllF2k.sS.AAA.0.0.BllF2k.AWX0_NP9IJA; sb=pF2UZSrV_4Nfw_jgBfpeYcun"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: fbsbx.comConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4IConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3vARUSXdOU64jtkye6CyLl0LgBbh2Xeqh7WeR0ZzSzlckjxHXhyTYmpbHGIHd4Iz9iEtWvQw HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4I"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2NZNoiTpBwBfcugfO8dl_pOBJuwsSuPo5D2On4lSPwPJBj3Nxg4P5ytI3oAn0sjNK362w0Hg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S369532415%3A1704222116503995&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4I"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4I"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=8903543573985932605&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=68741&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S369532415:1704222116503995",null,null,"ASKXGp2NZNoiTpBwBfcugfO8dl_pOBJuwsSuPo5D2On4lSPwPJBj3Nxg4P5ytI3oAn0sjNK362w0Hg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4I; OTZ=7365246_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4I; OTZ=7365246_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?o7q5Fw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:nSNNKEB8hpwxJUK2rnwJxp_gTP4tdQ:HHvxXLAO7VY6a684; OTZ=7365246_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=Xc4KLd8JC20; VISITOR_INFO1_LIVE=kWBjgiQt0EE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTQ%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=Xc4KLd8JC20; VISITOR_INFO1_LIVE=kWBjgiQt0EE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTQ%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=Xc4KLd8JC20; VISITOR_INFO1_LIVE=kWBjgiQt0EE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTQ%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=Xc4KLd8JC20; VISITOR_INFO1_LIVE=kWBjgiQt0EE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTQ%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=Xc4KLd8JC20; VISITOR_INFO1_LIVE=kWBjgiQt0EE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTQ%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=Xc4KLd8JC20; VISITOR_INFO1_LIVE=kWBjgiQt0EE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTQ%3D%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=Xc4KLd8JC20; VISITOR_INFO1_LIVE=kWBjgiQt0EE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgTQ%3D%3D"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: www.facebook.com"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.Esgs9sUIcrA.es5.O/am=P4GFJI4NgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGk5Vz2a80DM5XwjSrI9XblpXjVGw/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")70:T6a74,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 301 Moved PermanentlyLocation: https://www.facebook.com/loginStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: x4DCbiB8zeo9KYJVlvgcFa7Ju2YhL8d/iyYmSIogorLdoWZjD12trDP12s/NE6jb05XeR/jDb4tzbsbHQnyidQ==Date: Tue, 02 Jan 2024 19:01:56 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 0" "GET /security/hsts-pixel.gif?c=3.2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-AliveCookie: fr=0QCMrxLLmzhVkejUK..BllF2k.sS.AAA.0.0.BllF2k.AWX0_NP9IJA; sb=pF2UZSrV_4Nfw_jgBfpeYcun" "HTTP/1.1 302 FoundLocation: https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints: cross-origin-opener-policy: same-origin-allow-popupsAccess-Control-Allow-Origin: *Strict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: C+QJc0RGusuhiwgVP6rPfpKGZ8vhnOis8zPI5DyQPrGS9Td0GAiaDAlT3jNm/fZZ1XY0+0KsicrnU3ngjPmR3Q==Date: Tue, 02 Jan 2024 19:01:57 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 0" "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net" "HTTP/1.1 302 FoundLocation: https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints: cross-origin-opener-policy: same-origin-allow-popupsAccess-Control-Allow-Origin: *Strict-Transport-Security: max-age=31536000; preload; includeSubDomainsContent-Type: text/html; charset="utf-8"X-FB-Debug: /aaqOmyoZdTJy5UN0HmntAVp6uqxzweotdXjUhtVSyqCxMlsSjIt1MaR6wp3+aBR1lm95ZG7/R0abEmIdVwO4A==Date: Tue, 02 Jan 2024 19:01:59 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 0" "GET /security/hsts-pixel.gif?c=5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: fbsbx.comConnection: Keep-Alive" "HTTP/1.1 302 FoundLocation: https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints: cross-origin-opener-policy: same-origin-allow-popupsAccess-Control-Allow-Origin: *Strict-Transport-Security: max-age=31536000; preload; includeSubDomainsContent-Type: text/html; charset="utf-8"X-FB-Debug: HrBIxhsTk3byYlOJLr6WoOXl4duA6J9jVkKNilSUmdDbbZc/n89E9blaFsHRdufohdPv+RWQdTZDbzDLePIOnQ==Date: Tue, 02 Jan 2024 19:01:59 GMTAlt-Svc: h3=":443"; ma=86400Connection: keep-aliveContent-Length: 0" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4I;Path=/;Expires=Thu, 01-Jan-2026 19:01:56 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-CAMRF_WsPtfBqoP_sE5DDw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Tue, 02 Jan 2024 19:01:56 GMTExpires: Tue, 02 Jan 2024 19:01:56 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4IConnection: Keep-AliveDNT: 1" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j00000001�00000001000000001dc��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3vARUSXdOU64jtkye6CyLl0LgBbh2Xeqh7WeR0ZzSzlckjxHXhyTYmpbHGIHd4Iz9iEtWvQw HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4I", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Tue 02 Jan 2024 19:01:56 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3vARUSXdOU64jtkye6CyLl0LgBbh2Xeqh7WeR0ZzSzlckjxHXhyTYmpbHGIHd4Iz9iEtWvQwStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy: unsafe-noneCross-Origin-Resource-Policy: cross-originPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-8WnNr5_lJxS_0QZ-mlP6kA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2NZNoiTpBwBfcugfO8dl_pOBJuwsSuPo5D2On4lSPwPJBj3Nxg4P5ytI3oAn0sjNK362w0Hg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S369532415%3A1704222116503995&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:awsXyQzAZIPKDYTHFbnQkfjhffwLzw:kC1D_xtwYbTFuR4I", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Tue 02 Jan 2024 19:01:56 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2NZNoiTpBwBfcugfO8dl_pOBJuwsSuPo5D2On4lSPwPJBj3Nxg4P5ytI3oAn0sjNK362w0Hg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S369532415%3A1704222116503995&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-Ey1jPnR36qNMEtsWhx6JPw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�000000010000000100000001000000010000000100000001000000010000000100000001�00000001R000001]170o�0}�W�(P��X`��FH��0(�چ�1��*.{�a7Mz{�9'��Tw��g�tױ��֑�;��T�`EIר<�ҥ1ҥ_�,^{�x��o�C�B�#��Ϻ�55^ER��čP�L��n��Yb�4�=HR�$��%�$��:Ub(�K(�t�!X?%�g��,��۸��)Kҷ��}u�n�+�7��ڽ�%m��i�N{�� l�D[�O�p��7��ӽvj�*��>��:��.�C4 �g�|��4V%�^�G�7^㿖��d��P=��K+e��;yP��&��6��r��fk�K�9��m\~��", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001=00000001i00000001w00000001�00000001�00000001�00000001�00000001�001+1a26�d/Kl�!�^�/x�یgGKd�Y{��ou��B`;�;7sRwuUuum]-��(�u4��gJ��N=�t澕NI�UO��N�K�.�6@[H��c�խ-^��atT�mkPܲ��[0RC��y��0Y��)��;��a)E0[��II��3�TO�;R:��S��"��a��X�h��*�d��x��i�@��_�t5�ΥLE;��U�Wm�K^s㞔�>��[��KI��]�X.��ݝ�n�Pa�0��x��G[:��TJ��V5��M��pӂ�S�^��0��q3�$��w��.t<3cS0��á+\�Tl"`�}�o gtNgy3)#�[��n�X(q�*�͖��U�lqwO��V�-W0��Mv;�Je�+B˥z��5�N�q��T(��>�M�h�VD�Jq�ܵ��K�?��g��R�T�\�ܓy��4��}�5 ��v�H��nz��Bz��%qܔ��>ܗ�9��'��C_��o��~��~��W[��8��_o��#��6�/{E0��eO�K�O5d��p��>�-͏=��}��W�R)��Ѹf��͝�8��=8޹�=��c�`.��5�f��7.Z�]��Ry��G�7��{�e��?�)ޝ��)��:�A8\��C��.��l.�܀��Mc抻��>�fO��)PveY��t��7��b��}Cב�(�NK��y�Q쪈�Wv�Ga��7t}O��~~O�@V��R�ç��ӳ{<�[��;��j\4o�k��W:��]�ӷ(�;=^�_*tb�ݻ!m�T��g��{)X�ĽD:/�Ƚ��{i�m4��ۑ��p�l�ߵ�>��`砂�.R�:zmH:04^�]�d�@�靡V�8͝賢��S0�(ɇA��Q�!�"�2��o*Y�ޡ�X��%�Ґn��{c��V�+�U֝��w�ե,wA�Af�� 5T��Ct��P��K��z�B��:��cy*��UGQ]��ш�k`/@�lW�&X˩w�"�Am"r�m��d#��Ty$��", "��??�saS�x�q/\!AJ�5�e��-�a��m��Vuo�Q��s��b��oxj��[��jk��5�T/(�ou�{9S��Jb�<�@N��d�G��]��5��߳��A&n$)Tf��`��Ť쁇3��:lY`�γ!��)T�$(&��AbH��u��uBϱ�ȏH��藹lV��c�p��P�̽�,�;�Վ��ͫ��n��A�J/��K�r�)]��i�h��ry^��I�5��Ibɻ��B�ay��K��<�F��/5{��"+�ā[;��~�o��q�0]��*�eҁ�v$��5Э4`TpO�"�{��4��؇��~��h&�8��{4�=̡��f�K�7=�7\�پ��D�2˹��K;��/Q��L�$Or��^3�8zl��}{�\�+݊"��b騋�e��}�5��98�F9�;��%�)��w4�3N��z7ͳ��^��8��G��U�f�d�MD�/v��~y{A2�??hN�ȵ��|~up}t}�n��*�w7��{_A�ۯw{�y��䂻,��G�0��^��e\��k�ߒ��?|ۑ�e�+h��ޟ��`�^�p�zsH/~AphA�$�m:�j�E<.u�a�i�d�{F��4�׾�8ݱo�߷h�fV�YQ��}��]&;��o��X��Z��|��|�D�<�˩�^&[��XlCG�8n�n;��җ/R^7��f��3��@��j�x�eU�汗�SA��f��g&[��h�:F�y��w�C&�6�gPv��o��D��9v��j�ɺD:y2#��K3�'��ح~��.4��i��l�Ä��&��7t^v��3��;��M~2>� �à�P��(}eҤ*g[b:�矑}�j�>دL��z��0�> ��%XL�'>�h�d��Tlb}�V��7�v7#�@��*��ք��NY��S�^^��H@/ղ��l@.f+Tg<՟��;E��;5,�3��K��I��*��Q�_��σb+�M��<ִ�E�39��c��bC�;v��g��\��yȰ4Ċ&�"��74$#��h�5��RΥYsd�|)��"9]��I�s��!c�{2��=�-�c��֗��n^E��xP٧+Y��m��o��"ܹ��=u�cα��f�}��=T��zT�� wz��E��zb�_�Q�}��Ñ�L�զ�N�2�)T{��;=w��s\PD�r��4��O��W_{�[�V�.��.;{��x��'�N��1��n��pK�s[Xv��Ƀ<�z_Ϻ��YgK��s�z��k;��(�כp�'C>ய^�׃s�qk'2�4S�e��Jd�Fڠ�f��*��'o޵fc|��m��`Ӛ�8��Cc��S�$2��X �6��S��)�+�T��0ޚVž��&0��/��/�l��lƱx�ƉT�\��u�0L�ج�!.�f�)�e�G ys��f!]�a��%=0�M8]��2L^U_�X*�/o�\�*��D�v��A�֢��5��-� _�=��7�y�6^�tAV�U�Z��p��p�'�*��X��q!��t"�N�f�Bb!�PD��CL��Q��L�ԫUR�[��Y�%^��gM�0�,׸�e��2_�k�!ަ̸�Ⱁ��cJ�I��S\Y�St�s/�:N�R#�w�&� z�jA7��e|�{�ը�%�B��u�(��t"�9�$F�Kt�T�=5�`�]��g�>�Pր��w��*s��t��o�w��2t:��u�u�(�vԲĨg��c`檪KB_�P�j"�d�y�Զls��7�W��s�`F�foj�9��.+�3��RL�c�_\�Yh%��j�kt�E�7�8�(rJ�r��K"*��3I~}c��H��G��MgAd@��_�Uc��*��[�rԢ��k��֜[��3��(NŒ�b-��@��9�$�`�^��$��5N!�;�Y��,[[h]`�4�0�2�]�R♈l��P�z��4��:�li��v��8A�s�y2��UR�'� [�2��t��8�M&�bv:�ob\a��c�5*�fg��xy�I�o2Q�Bv��F??ۈ��Q'2c�'�%3�E��R�UO�i�7Ḃ�4;��BS6?tOY(�#�y�v�ҵcrm��W��9�F��'*7��"��[(=��Ǣ�[J��2��x�r��-�o�q��b�!��K��.wߓaDw��S�1AvG�|&Ѵ��0�i,iJ��J�|q'[�/�㠑�x#PUSͅg�I��A'ݣhW�D��q��Bj��!�"��1�z��ݐC��7w��&Fi�>�U��}��^WF��E��Ԩlp}�/��-`�?�?�m`�F*��0�[/�.��65�L�(J`.�34bUDEq��6!��G��?�6Bz�ץT�<��J�v=[v��cH��Gk��oI�Z}z[i9tqݣ��N4�gZp�,-�z��ˎ��FS�&�8H��JA-d��F��(��JK�jB��JS��M�)R�o�:W��mΥL�n�6�40^��v# �MU3(wRԾ�y}��w`��", "y%o�a�h��l��R��z��p��n�'ao��6�H��]Y:��]C&�B|��84xL4c�9�L�z�VQ+ZQX��,��Ԫ>3DBOq�7�.̝$�B��f��ɂ%��+��|b��#�5��A��!�L�>؜l�A��@|�?y�D�%��z_�?9?��<[�}(�6��P`3��Gy�l�Eu�O�lu^Q�}��F�n��Q4}�d>��י�,��]�J�JQ.]L6(�j��M0��7��r��[��\�0��T��p6�H�&)��Wf��i��M|6�jV�l]3�}��H$t��r��R[K"�1��la#��Q{��-�lw�p3�m�bY<�ZQT�. .)�k��:TJfL��Pt��Γ�Ž�o��s|n��2C�T�IR��}Y?$��2��0��}k��8��Ze4c��*y)`�_��p�PØ��!�p�/�˽tX��?8<��*�(��/�.�o��e\n&�h��֨�Y쏕�ʊu��i,��6H��+%:%Id�SX��:��A��[�3�pr�.5M.�7ڥ.��7{��p��Q��﹋��s��ށ��=b��b�ձ�1)��r��;�FR�9�BJ��3E>�̤�sc��Si�Iɯ��;x��C�ꙓ�*��8��.7ݼ�7��Z�X�.2ZX��a{��H�t��^ڍ�,��7Ū$Z�2½��E?wct�A-੗��3G��]X��ǂ�|}�A�*Z�c�x|��C��!��r��}�A��'p��gn��ö�X�Y��[��GFn܈�h��Л��&r��7lH�&??��@9��ȵ�^<��]��V#?q�p�gwv;�m�T�N>��.�,M��7Md��z�)VfU,�c��8�A��-Y�Y�U`�B�&��U��l�8�Vۑ�?p��?��T��*��/��Du��D��}B��7.��%/�r2�I�r`�G;�h�+=��&�ݫ��"�ǥ�$)S|�_Ԫ�q��p�JJ�#<�I�3�OrӘ�+�E�B)�'K�/�X7x��`��͋|U6U4G)�gp��l��p�%܇G��*�w�'�{T4/+o��:!�� Q��a*X��8I��O��H��G��X�|��i��ǫHSY3B�3b�!� d%7��i�4�p�)�0�E��Rt��!�]?�Gw�f&��{�(�T�%��Y�|��^r��Z��#��o��fJ>�})]��ퟘ0��/��+��)M�Fn�m��?8ۈ<�\��Z%͐�6�9��", "(w�R��çfQ)41��9VO�ˤ�/A��>D�0�X�%7M9£7J9␬�rD;��D��Et߲�T�Y8��s*n�YS�Z@�39��5r��kz��6��ͱ/>�X�/��8��oƤZ`��«k�w��؎#��N��X��\��|Y}"��9�$��k��uP�L��r�P,d��H��uC�oc{��!�.�>��ז#W��!�q�(�T�\��l[M6��o E�'�0��H��_]ZBp>��%Z1��K��>xq��\��+V��Ά��+Q�H��J�w5�ʌ�Ȗ|�YŘ�o`�R�J�6̗VO��įU�p��(�6|5h��a��#s�f�韖��i��`�qO��c�$�=�ڎe��g�U�1H��_9��%x��o�F��1��ző��D�s��lm�(w�Cc��f�䢐�@��k"`k��\�n�%�x��D��_]!��?�Z�B��s<��", "00000001�0000000100000001k00000001o00000001�00000001600000001�00000001�00000001�00000001K00000001�0000000100000001�00000001200000001�00000001N00000001\0001%ac2ƀ�ˊ�k��E?8��8�#��4i��"%�'>��l��v,��>�)RJ��+�W��X�MZ5�S^��??�7��d�}eT��udTtdyN�([_��9ɡ��Ny�N��_�Pe�$07�r1oo�ͺ��Ċ��=��׫C�O��j�c)9L=�}z�vlL�y.��u!�jd�"�Ӎ!�ռ�!@Ol��G�+��>�TU��1�'v^��\XtT&�e6�.m�"!]��_e��x��{@]`H:G�Cm��[�;��f�uq��.#B5�i3��cvgkiD�x��nP:��tQ�A�[�.�r��??�W��x�ǭH��f@�#]H��]G�KG6o�&�x��*��ti5��""�l��q�fXJ��g8��C��*�a��g8J��R`5��'7��l�"!űU9��=�?�@�kBb��d�jIF��(슠tB@%�J6��k�ac�6�0c��1�fF��uH��"�9�[(��0rZTX1"T3�4��F��J��@�#D�j@��j��l�e��l-��MD��h��E��3��G�:F�`�@��"N=t�nYĉ��M�[q", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jan 2024 19:01:56 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-1IdokEerefiqpbHE63W2MA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: same-siteContent-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "b��q�N=�Ͼ��g��7��+�)��H>$g��9�6��Q�+g�1�B��FD��p�..�k�/��}i|�V�]��j{��>��ep;��;�$��$}�*I��FHz{�sv��Oh�k鹛�O�g3n�4�BX�syw0��~�ˏzv��أ�^{o�o��Ǐ�՞��2NRwr��kѳ��wxao��ft�+�u�*c�/5��,%�Re�QTxNW'�^��Ӌ��J\�(� �f�1-��i(Vy�(�9M��+j��e��w|o�X�A�!�U�H4U��x��7��h��/P@�;�M�V3�_.-�Kօ�-�6t3@}U"C�G��l�Ah�[xWE�"|L��GVܗ�n��b0��;�H��0N��sP��A��K�;Ŀ�'�T��^H�Ub)%/�fYE�p�TBTlw�iՙ��|t�k��nq?��N��0P�>t?�*�x��x�� ս#W�`��xC�R��7�f��A?�ʏ��f�#��ɐeV�Ё#�!x�FY_�PѲ��@�=�#|�AV��h|��|�=�;2R�,a{A��}�f?�OW��e"��bp�O�i��0l}�/�q��?��"71:T7bb,Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Tue, 02 Jan 2024 19:02:09 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: www.facebook.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Sat, 30 Dec 2023 12:35:19 GMTExpires: Sun, 29 Dec 2024 12:35:19 GMTAge: 282400Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")72:T29c7,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 02 Jan 2024 18:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 02 Jan 2024 18:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcw2OhODNdUsdsGX9WUu4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAdcw2O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAdcw2OhODNdUsdsGX9WUu4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvz" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3z" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQClj3zJOwEs2AlR6v%2BfUXog HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYr" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA1uFYrLabZxEtE2U5X5DGM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAUov%2BRSzckSEFSlqgvND%2Fg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "86sKLUnojgk259UfHIz70m4F6ewSKJ3qO" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=86sKLUnojgk259UfHIz70m4F6ewSKJ3qOI2BrvcxzS8-1704222148-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: soupinterestoe.fun" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"73:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: sLMNFasP7gH_1_.js74:T591,"6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003824) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003824) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindNextFileW" with parameter 7MJ8gW89.exe (UID: 00000000-00003824) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindNextFileW" with parameter rb7ZA41.exe (UID: 00000000-00003824) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00003824) "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003824) "rb7ZA41.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003324) "rb7ZA41.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003324) "rb7ZA41.exe" called "FindNextFileW" with parameter 6Mb3Ab2.exe (UID: 00000000-00003324) "rb7ZA41.exe" called "FindNextFileW" with parameter te3ZF22.exe (UID: 00000000-00003324) "rb7ZA41.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003324) "rb7ZA41.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003324)75:T8004,"initAft()