26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 81:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper/Generic.X2198 Sample 6dc5f3bd7f01… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6dc5f3bd7f01…. Malware family: Dropper/Generic.X2198. Threat score 100/100. 5/28 AV engines flagged this file. 14 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6dc5f3bd7f01781b4aaf942e08fee8afbbf1c6ff98a701195537e5a5571caed7","keywords":["Malicious","Dropper/Generic.X2198","malware analysis","sandbox report","threat intelligence","6dc5f3bd7f01781b4aaf942e08fee8afbbf1c6ff98a701195537e5a5571caed7"],"about":{"@type":"SoftwareApplication","name":"6c752b163faa36a307dfe59849216aff.exe","applicationCategory":["peexe","executable"],"identifier":"6dc5f3bd7f01781b4aaf942e08fee8afbbf1c6ff98a701195537e5a5571caed7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper/Generic.X2198","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5d5,"6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905272" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905280" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905308" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905520" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905336" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905492" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905504" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "7272180" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905388" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905484" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "7272176" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905352" - (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "FindResourceA" with parameter "1905360" - (UID: 00000000-00002448)28:Tb88,"6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951872'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951728'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951888'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951776'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951744'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951792'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951840'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951712'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951824'}" (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951856'}" (UID: 00000000-00002448) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697472'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697328'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697488'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697376'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697344'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697392'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697440'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697312'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697424'}" (UID: 00000000-00002128) "vY0YT87.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16697456'}" (UID: 00000000-00002128) "VH2Zk03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190144'}" (UID: 00000000-00001036) "VH2Zk03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190000'}" (UID: 00000000-00001036) "VH2Zk03.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190160'}" (UID: 00000000-00001036)29:T498,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")2a:T434,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")2b:T663,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6Yj0YY4.exe.2678680568") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")2c:T1085,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")2d:T12e9,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-71-00FE2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-71-00FE2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-73-00FE17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-73-00FE17EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-40-00FE2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-40-00FE2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-15-00FE1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-15-00FE1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-42-00FE202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00002128-41303-42-00FE202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-42-00FE202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-52-00FE4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-52-00FE4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-65-00FE53A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-65-00FE53A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-72-00FE18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-72-00FE18A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-60-00FE597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-60-00FE597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-29-00FE52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-29-00FE52B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-62-00FE55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-62-00FE55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-22-00FE681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-22-00FE681F Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002128-41303-36-00FE3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002128-41303-36-00FE3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-26-00FE24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-26-00FE24E0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002128-41303-31-00FE2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002128-41303-31-00FE2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-37-00FE3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-37-00FE3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002128-41303-77-00FE2773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002128-41303-77-00FE2773 Assembly shows XOR instruction xor al D7h in Stream UID: 46658-240-00423D47 Assembly shows XOR instruction xor ecx 953E781Ch in Stream UID: 46658-240-00423D47 Assembly shows XOR instruction xor eax 00000626h in Stream UID: 46658-228-0041CF16 Assembly shows XOR instruction xor ecx 00009AF6h in Stream UID: 46658-228-0041CF16 Assembly shows XOR instruction xor eax B12F93A5h in Stream UID: 46658-227-0041E43A Assembly shows XOR instruction xor ebx eax in Stream UID: 46658-531-00406BC8 Assembly shows XOR instruction xor edi eax in Stream UID: 46658-531-00406BC8 Assembly shows XOR instruction xor esi eax in Stream UID: 46658-531-00406BC8 Assembly shows XOR instruction xor esi 6BD5E087h in Stream UID: 46658-238-0041EA51 Assembly shows XOR instruction xor eax 0C7B303Fh in Stream UID: 46658-238-0041EA51 Assembly shows XOR instruction xor eax ebp in Stream UID: 46658-521-00408DE2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 46658-521-00408DE2 Assembly shows XOR instruction xor edi dword ptr [0042C018h] in Stream UID: 46658-116-0040A8DE Assembly shows XOR instruction xor eax 0000C2B2h in Stream UID: 46658-214-004233AC Assembly shows XOR instruction xor cl 0Bh in Stream UID: 46658-214-004233AC Assembly shows XOR instruction xor cl 9Bh in Stream UID: 46658-214-004233AC Assembly shows XOR instruction xor ecx FB043B26h in Stream UID: 46658-214-004233AC Assembly shows XOR instruction xor ax cx in Stream UID: 46658-214-004233AC2e:Tefa,"6c752b163faa36a307dfe59849216aff.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002448) "vY0YT87.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002128) "vY0YT87.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002128) "VH2Zk03.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001036) "VH2Zk03.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001036)2f:T47c,"6c752b163faa36a307dfe59849216aff.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f56e005c7b1e73289ac10200000000a8f56e00b4441e73289ac10200f66e0065251e73289ac102010000008ddb6c3a000000003d1bf2200000000003000000b4f66e000a00000080060000f8f66e0030f66e005b00000003000000b8f56e00c0f56e00c8f86e00e0561e73cd3d2249feffffff08f76e0047f21c733d1bf220 (UID: 00000000-00002448) "vY0YT87.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f5e2005c7b1e73a8ac0e010000000080f5e200b4441e73a8ac0e01d8f5e20065251e73a8ac0e0101000000b2f54e500000000058f5cd1600000000030000008cf6e2000a000000c0040000d0f6e20008f6e2005b0000000300000090f5e20098f5e200a0f8e200e0561e732a108c23feffffffe0f6e20047f21c7358f5cd16 (UID: 00000000-00002128) "VH2Zk03.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fba9005c7b1e7330bc050300000000b0fba900b4441e7330bc050308fca90065251e7330bc050301000000fee35cc20000000096d16c160000000003000000bcfca9000a000000ec04000000fda90038fca9005b00000003000000c0fba900c8fba900d0fea900e0561e73b60fd5b1feffffff10fda90047f21c7396d16c16 (UID: 00000000-00001036)30:T470,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")31:T84a,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "7ol4Gg17.exe.2029473918") Found reference to API "677852259,1260,3024,,RtlGetVersion,NTDLL.dll,"00:17:19.875",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "772662700,1216,3024,,RtlGetVersion,NTDLL.dll,"00:17:19.562",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")32:Tac9,"6c752b163faa36a307dfe59849216aff.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002448) "vY0YT87.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002128) "vY0YT87.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002128) "vY0YT87.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002128) "vY0YT87.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002128) "vY0YT87.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002128) "vY0YT87.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002128) "vY0YT87.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002128) "VH2Zk03.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001036) "VH2Zk03.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001036) "VH2Zk03.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001036) "VH2Zk03.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001036) "VH2Zk03.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001036) "VH2Zk03.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00001036) "VH2Zk03.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001036) "3PA29Ih.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002144) "3PA29Ih.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002144) "3PA29Ih.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002144) "3PA29Ih.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002144)33:T4a4c,"6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002448) "6c752b163faa36a307dfe59849216aff.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002448) "vY0YT87.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002128) "vY0YT87.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00002128) "VH2Zk03.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00001036) "VH2Zk03.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001036) "3PA29Ih.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002144) "3PA29Ih.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002144)34:T1672,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000001.68773.00CF0000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "681538551,1260,3136,,CreateProcessA,kernel32.dll,"00:17:19.890",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000000.66826.03600000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "774216112,1216,3136,,CreateProcessA,kernel32.dll,"00:17:19.562",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000000.66874.02870000.00000004.mdmp, 00000000-00002144.00000000.66874.028C0000.00000004.mdmp, 00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.028C0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000000.66874.028C0000.00000004.mdmp, 00000000-00002144.00000002.70712.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp")35:T10ad,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")36:T97d,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "6Yj0YY4.exe.2678680568") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")37:Tf59f,Found reference to API (Indicator: "CheckTokenMembership"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "DecryptFileA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "FreeSid"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "EqualSid"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "RegCloseKey"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "FindNextFileA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "FindClose"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LocalAlloc"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "lstrcmpA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CompareStringA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetLastError"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "DeleteFileA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GlobalFree"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CloseHandle"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetProcAddress"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GlobalLock"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LocalFree"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "FreeLibrary"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "ReadFile"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SizeofResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "WriteFile"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetFileTime"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetFilePointer"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "FindResourceA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CreateMutexA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "FreeResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetVersion"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetTempPathA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CreateFileA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetEvent"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "TerminateThread"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetVersionExA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LockResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CreateThread"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "ResetEvent"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LoadResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "ExitProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CreateProcessA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "FormatMessageA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CreateEventA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CharUpperA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "MessageBeep"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CharPrevA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LoadStringA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CharNextA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "EnableWindow"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "ReleaseDC"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "PeekMessageA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SendMessageA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "MessageBoxA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "ShowWindow"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetWindowPos"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetDC"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetWindowRect"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "Sleep"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "TerminateProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetTickCount"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "MulDiv"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "VirtualFree"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "VirtualAlloc"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "InitializeSListHead"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "RtlUnwind"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "SetLastError"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "EnterCriticalSection"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "TlsAlloc"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "TlsGetValue"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "TlsSetValue"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "TlsFree"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "LoadLibraryExW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "EncodePointer"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "RaiseException"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetStdHandle"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "HeapFree"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "HeapAlloc"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "HeapReAlloc"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "LCMapStringW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "FindFirstFileExW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "FindNextFileW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "IsValidCodePage"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetACP"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetOEMCP"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetCPInfo"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetCommandLineA"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetCommandLineW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "SetStdHandle"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetFileType"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetStringTypeW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetProcessHeap"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "HeapSize"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "FlushFileBuffers"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "GetConsoleMode"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "SetFilePointerEx"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "CreateFileW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "WriteConsoleW"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "DecodePointer"; File: "6Yj0YY4.exe.2678680568") Found reference to API (Indicator: "RtlGetVersion"; File: "7ol4Gg17.exe.2029473918") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "7ol4Gg17.exe.2029473918") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "7ol4Gg17.exe.2029473918") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "7ol4Gg17.exe.2029473918") Found reference to API (Indicator: "GetLongPathNameW"; File: "7ol4Gg17.exe.2029473918") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "7ol4Gg17.exe.2029473918") Found reference to API (Indicator: "UnregisterWait"; File: "7ol4Gg17.exe.2029473918") Found reference to API (Indicator: "GetCurrentThread"; File: "7ol4Gg17.exe.2029473918") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001036.00000001.68773.00E71000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001036.00000001.68773.00E71000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00001036.00000001.68773.00E71000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002128.00000002.70669.00FE1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002128.00000002.70669.00FE1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002128.00000002.70669.00FE1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002448.00000001.68720.001D1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002448.00000001.68720.001D1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002448.00000001.68720.001D1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")38:Ta21,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")39:Te1e,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp")3a:T473,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "6Yj0YY4.exe.2678680568") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")3b:Tc5e,"6c752b163faa36a307dfe59849216aff.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76ff0000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76ff0000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76ff0000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "KERNEL32" at base 74ab0000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73170000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "KERNEL32.DLL" at base 74ab0000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75bf0000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "FECLIENT.DLL" at base 73150000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73100000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "NTDLL.DLL" at base 77740000 "6c752b163faa36a307dfe59849216aff.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 740b0000 "vY0YT87.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76ff0000 "vY0YT87.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76ff0000 "vY0YT87.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76ff0000 "vY0YT87.exe" loaded module "KERNEL32" at base 74ab0000 "vY0YT87.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73170000 "vY0YT87.exe" loaded module "KERNEL32.DLL" at base 74ab0000 "vY0YT87.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75bf0000 "vY0YT87.exe" loaded module "FECLIENT.DLL" at base 73150000 "vY0YT87.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73100000 "vY0YT87.exe" loaded module "NTDLL.DLL" at base 77740000 "vY0YT87.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 740b0000 "VH2Zk03.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76ff0000 "VH2Zk03.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76ff0000 "VH2Zk03.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76ff0000 "VH2Zk03.exe" loaded module "KERNEL32" at base 74ab0000 "VH2Zk03.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73170000 "VH2Zk03.exe" loaded module "KERNEL32.DLL" at base 74ab0000 "VH2Zk03.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75bf0000 "VH2Zk03.exe" loaded module "FECLIENT.DLL" at base 73150000 "VH2Zk03.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73100000 "VH2Zk03.exe" loaded module "NTDLL.DLL" at base 77740000 "VH2Zk03.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 740b0000 "3PA29Ih.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76ff0000 "3PA29Ih.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76ff0000 "3PA29Ih.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76ff0000 "3PA29Ih.exe" loaded module "KERNEL32" at base 74ab0000 "3PA29Ih.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73170000 "3PA29Ih.exe" loaded module "USER32" at base 75010000 "3PA29Ih.exe" loaded module "ADVAPI32" at base 75bf0000 "3PA29Ih.exe" loaded module "SHELL32" at base 75c700003c:Taba,"6c752b163faa36a307dfe59849216aff.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6c752b163faa36a307dfe59849216aff.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6c752b163faa36a307dfe59849216aff.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6c752b163faa36a307dfe59849216aff.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6c752b163faa36a307dfe59849216aff.exe" was detected as "Microsoft Linker" and name: "Linker" "vY0YT87.exe" was detected as "Microsoft Cabinet" and name: "sfx" "vY0YT87.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vY0YT87.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vY0YT87.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "vY0YT87.exe" was detected as "Microsoft Linker" and name: "Linker" "VH2Zk03.exe" was detected as "Microsoft Cabinet" and name: "sfx" "VH2Zk03.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "VH2Zk03.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VH2Zk03.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "VH2Zk03.exe" was detected as "Microsoft Linker" and name: "Linker" "5hi3ts2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5hi3ts2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5hi3ts2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5hi3ts2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5hi3ts2.exe" was detected as "Microsoft Linker" and name: "Linker" "6Yj0YY4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6Yj0YY4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6Yj0YY4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6Yj0YY4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6Yj0YY4.exe" was detected as "Microsoft Linker" and name: "Linker" "7ol4Gg17.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7ol4Gg17.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7ol4Gg17.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7ol4Gg17.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7ol4Gg17.exe" was detected as "Microsoft Linker" and name: "Linker" "3PA29Ih.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3PA29Ih.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3PA29Ih.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3PA29Ih.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3PA29Ih.exe" was detected as "Microsoft Linker" and name: "Linker"3d:Tf54,"6c752b163faa36a307dfe59849216aff.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "vY0YT87.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "VH2Zk03.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5hi3ts2.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "6Yj0YY4.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42cd34," "7ol4Gg17.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "3PA29Ih.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4],"3e:T468,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6Yj0YY4.exe.2678680568") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")3f:T64a,"6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")40:Tc75,"6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "6C752B163FAA36A307DFE59849216AFF.EXE"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")41:Tc51,"6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VY0YT87.EXE" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\vY0YT87.exe" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7OL4GG17.EXE" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7ol4Gg17.exe" "vY0YT87.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "vY0YT87.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "vY0YT87.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "vY0YT87.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "vY0YT87.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VH2ZK03.EXE" "vY0YT87.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VH2Zk03.exe" "vY0YT87.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6YJ0YY4.EXE" "vY0YT87.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Yj0YY4.exe" "VH2Zk03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "VH2Zk03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "VH2Zk03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "VH2Zk03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "VH2Zk03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3PA29IH.EXE" "VH2Zk03.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3PA29Ih.exe" "VH2Zk03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5HI3TS2.EXE" "VH2Zk03.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5hi3ts2.exe" "3PA29Ih.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"42:T46d,"6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "\Device\HarddiskVolume2\6C752B163FAA36A307DFE59849216AFF.EXE.LOCAL" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "6c752b163faa36a307dfe59849216aff.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "vY0YT87.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VY0YT87.EXE.LOCAL" "vY0YT87.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "vY0YT87.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "VH2Zk03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VH2ZK03.EXE.LOCAL" "VH2Zk03.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "VH2Zk03.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"43:Tb01,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")44:T4e0,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "6Yj0YY4.exe.2678680568") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "6Yj0YY4.exe.2678680568") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")45:T75d,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6Yj0YY4.exe.2678680568") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6Yj0YY4.exe.2678680568") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")46:Td6b,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")47:T690,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")48:Tf44,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")49:T66f,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")4a:T682,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp")4b:Tb3c,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")4c:T97d,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")4d:Tb35,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001036.00000001.68773.00E71000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001036.00000001.68773.00E71000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002128.00000002.70669.00FE1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002128.00000002.70669.00FE1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002448.00000001.68720.001D1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002448.00000001.68720.001D1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")4e:T9c5,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")4f:T11e9,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00001036.00000000.66852.03030000.00000004.mdmp, 00000000-00001036.00000002.70691.03030000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002128.00000000.66826.010C0000.00000004.mdmp, 00000000-00002128.00000002.70669.010C0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002144.00000000.66874.029F0000.00000004.mdmp, 00000000-00002144.00000002.70712.029F0000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002448.00000000.66798.02BF0000.00000004.mdmp, 00000000-00002448.00000002.70637.02BF0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")50:T480,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "6c752b163faa36a307dfe59849216aff.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "6Yj0YY4.exe.2678680568") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")51:Tada,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 6c752b163faa36a307dfe59849216aff.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 6c752b163faa36a307dfe59849216aff.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 6c752b163faa36a307dfe59849216aff.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 6c752b163faa36a307dfe59849216aff.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 6c752b163faa36a307dfe59849216aff.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: vY0YT87.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: vY0YT87.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: vY0YT87.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: vY0YT87.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: vY0YT87.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: VH2Zk03.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: VH2Zk03.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: VH2Zk03.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: VH2Zk03.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: VH2Zk03.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5hi3ts2.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5hi3ts2.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5hi3ts2.exe]52:T400,Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "ExitWindows"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00001036.00000002.70691.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00002128.00000002.70669.00FEA000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00002448.00000002.70637.001DA000.00000002.mdmp")53:T43e,"6c752b163faa36a307dfe59849216aff.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "6c752b163faa36a307dfe59849216aff.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "vY0YT87.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "vY0YT87.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "VH2Zk03.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "VH2Zk03.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"")54:T98a,"6c752b163faa36a307dfe59849216aff.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\vY0YT87.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6c752b163faa36a307dfe59849216aff.exe" wrote 27648 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7ol4Gg17.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vY0YT87.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VH2Zk03.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vY0YT87.exe" wrote 31744 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Yj0YY4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VH2Zk03.exe" wrote 31710 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3PA29Ih.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "VH2Zk03.exe" wrote 1058 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5hi3ts2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...55:T4a9,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA LookupAccountNameA GetUserNameA GetDriveTypeW GetThreadContext WriteProcessMemory GetModuleFileNameW CopyFileA LoadLibraryExW GetModuleHandleExW GetVersionExW ReadProcessMemory DeleteFileW FindNextFileW GetComputerNameExW FindFirstFileExW CreateFileW IsDebuggerPresent VirtualAllocEx GetCommandLineW GetCommandLineA GetModuleHandleA VirtualAlloc ShellExecuteA HttpSendRequestA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetOpenW GetNativeSystemInfo CreateDirectoryW GetTempFileNameW LoadLibraryW GetSystemDirectoryW GetTempPathW FindResourceW CreateProcessW ShellExecuteExW GetWindowThreadProcessId56:T51b3,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "73Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=i66jZc1V3K2rCq6qOZl4Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Ktmk" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "2Bmc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2BXrrguICEAxnRZO2jQMmUC0dFSq96X0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fdiu84vFCW7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BzP1lEY" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"57:T70a,Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00000824.00000000.68371.00417000.00000004.mdmp, 00000000-00000824.00000002.70990.00417000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000824.00000000.68371.00417000.00000004.mdmp, 00000000-00000824.00000002.70990.00417000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000824.00000000.68371.00417000.00000004.mdmp, 00000000-00000824.00000002.70990.00417000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000824.00000000.68371.00417000.00000004.mdmp, 00000000-00000824.00000002.70990.00417000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00002988.00000000.66663.000D0000.00000004.mdmp, 00000000-00002988.00000001.68582.000D0000.00000004.mdmp, 00000000-00002988.00000003.71073.000D0000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002988.00000000.66663.000D0000.00000004.mdmp, 00000000-00002988.00000001.68582.000D0000.00000004.mdmp, 00000000-00002988.00000003.71073.000D0000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002988.00000000.66663.000D0000.00000004.mdmp, 00000000-00002988.00000001.68582.000D0000.00000004.mdmp, 00000000-00002988.00000003.71073.000D0000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002988.00000000.66663.000D0000.00000004.mdmp, 00000000-00002988.00000001.68582.000D0000.00000004.mdmp, 00000000-00002988.00000003.71073.000D0000.00000004.mdmp")58:Tadc,"explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "6Yj0YY4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "6Yj0YY4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "6Yj0YY4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "6Yj0YY4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "6Yj0YY4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "")59:T6fc,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003000.00000000.67310.00360000.00000004.mdmp 00000000-00003000.00000001.69232.00360000.00000004.mdmp 00000000-00003000.00000002.71152.00360000.00000004.mdmp 00000000-00003000.00000003.79819.00360000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003000.00000000.67310.00360000.00000004.mdmp 00000000-00003000.00000001.69232.00360000.00000004.mdmp 00000000-00003000.00000002.71152.00340000.00000002.mdmp 00000000-00003000.00000002.71152.00360000.00000004.mdmp 00000000-00003000.00000003.79819.00360000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003000.00000000.67310.00360000.00000004.mdmp 00000000-00003000.00000001.69232.00360000.00000004.mdmp 00000000-00003000.00000002.71152.00360000.00000004.mdmp 00000000-00003000.00000003.79819.00360000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003000.00000000.67310.00360000.00000004.mdmp 00000000-00003000.00000001.69232.00360000.00000004.mdmp 00000000-00003000.00000002.71152.00340000.00000002.mdmp 00000000-00003000.00000002.71152.00360000.00000004.mdmp 00000000-00003000.00000003.79819.00360000.00000004.mdmp5a:T64a,"vY0YT87.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "vY0YT87.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "VH2Zk03.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "VH2Zk03.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5hi3ts2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "6Yj0YY4.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "6Yj0YY4.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6Yj0YY4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "7ol4Gg17.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "7ol4Gg17.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135]5b:Tc90,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "6c752b163faa36a307dfe59849216aff.exe") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "6c752b163faa36a307dfe59849216aff.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "45B7.bat") file/memory contains long string with (Indicator: "paypal"; File: "376JHBRQ.txt") file/memory contains long string with (Indicator: "paypal"; File: "Q026SLP2.txt") file/memory contains long string with (Indicator: "paypal"; File: "7NQ1XFSJ.txt") file/memory contains long string with (Indicator: "paypal"; File: "BHC7MXYR.txt") file/memory contains long string with (Indicator: "paypal"; File: "BXERLZZW.txt") file/memory contains long string with (Indicator: "paypal"; File: "4X2GPOGT.txt") file/memory contains long string with (Indicator: "paypal"; File: "OXBRKZ0J.txt") file/memory contains long string with (Indicator: "paypal"; File: "T18ZDNFR.txt") file/memory contains long string with (Indicator: "paypal"; File: "37I6RBYB.txt") file/memory contains long string with (Indicator: "twitter"; File: "8CUT7DNS.txt") file/memory contains long string with (Indicator: "youtube"; File: "LDOY7MMU.txt") file/memory contains long string with (Indicator: "paypal"; File: "QRV4EELG.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_3_.css") file/memory contains long string with (Indicator: "twitter"; File: "KW8MHBZJ.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "0B9PIJX2.txt") Found string "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948" (Indicator: "paypal"; File: "I4T8Q6XE.txt") Found string "VISITOR_INFO1_LIVEbx5CDLJQ4hYyoutube.com/9217390140377631103119174973830331066941CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217174431910431069726144155080331066941" (Indicator: "youtube"; File: "8CLQ1JN0.txt") Found string "0RN0120N2KbaoWET2..BlP4kq.Qq.AAA.0.0.BlP4kq.AWWojVA97zAfacebook.com/921715933056031085015270202973131066948Kok_Zdovq1CHPpUbnSTXe4gBfacebook.com/9217170378470431147376332906098131066948" (Indicator: "facebook.com"; File: "3HRP3T6C.txt") Found string "guest_id_marketingv1%3A169866271866844849twitter.com/102549983974431213761175969325131066953guest_id_adsv1%3A169866271866844849twitter.com/102549983974431213761208856825131066953" (Indicator: "twitter"; File: "W23HEDGA.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217174431910431069726144155080331066941" (Indicator: "youtube"; File: "3HRJTKQ7.txt") Found string "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948" (Indicator: "paypal"; File: "CWLWJZG2.txt") Found string "CheckConnectionTempCookie81915432accounts.youtube.com/accounts/2147484752172379443231066958162613802231066958" (Indicator: "youtube"; File: "0PP39YOO.txt")5c:T30f0,"@shift /0start "" https://accounts.google.comstart "" https://www.facebook.com/loginstart "" https://accounts.google.comstart "" https://store.steampowered.com/login/start "" https://twitter.com/i/flow/loginstart "" https://steamcommunity.com/openid/loginform/start "" https://www.epicgames.com/id/loginstart "" https://www.paypal.com/signinstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948vreXpYrS%3D1793270706%26vteXpYrS%3D1698664506%26vr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60%26vtyp%3Dnewpaypal.com/9217240613094431287186235297013931066950ts_cvr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60paypal.com/1025239613094431287186235406388931066950" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948vreXpYrS%3D1793270705%26vteXpYrS%3D1698664505%26vr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60%26vtyp%3Dnewpaypal.com/9217239613094431287186235281388931066950ts_cvr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60paypal.com/1025239613094431287186235406388931066950" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948vreXpYrS%3D1793270706%26vteXpYrS%3D1698664506%26vr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60%26vtyp%3Dnewpaypal.com/9217240613094431287186235297013931066950ts_cvr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60paypal.com/1025240613094431287186235422013931066950" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948vreXpYrS%3D1793270705%26vteXpYrS%3D1698664505%26vr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60%26vtyp%3Dnewpaypal.com/9217239613094431287186235281388931066950ts_cvr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60paypal.com/1025231613094431287186176431098131066948" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948vreXpYrS%3D1793270707%26vteXpYrS%3D1698664507%26vr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60%26vtyp%3Dnewpaypal.com/9217241613094431287186387947013931066950ts_cvr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60paypal.com/1025240613094431287186235437638931066950" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948vreXpYrS%3D1793270707%26vteXpYrS%3D1698664507%26vr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60%26vtyp%3Dnewpaypal.com/9217241613094431287186387947013931066950ts_cvr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60paypal.com/1025241613094431287186388778263931066950" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948vreXpYrS%3D1793357097%26vteXpYrS%3D1698664497%26vr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60%26vtyp%3Dnewpaypal.com/9217231613094431287186175740473131066948ts_cvr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60paypal.com/1025231613094431287186176431098131066948" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948vreXpYrS%3D1793357097%26vteXpYrS%3D1698664497%26vr%3D802fcb9b18b0aa3084f279b2fea10f61%26vt%3D802fcb9b18b0aa3084f279b2fea10f60%26vtyp%3Dnewpaypal.com/9217231613094431287186175740473131066948" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948tsrceunifiedloginnodewebpaypal.com/9217265694515231067513175740473131066948" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948LANGen_US%3BUSpaypal.com/9217255961203231066983175724848131066948" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948d_id08f0a9d5391c4476b89b8c7124caac001698662697927paypal.com/9217144502067231801768175693598131066948" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948cookie_checkpaypal.com/9217144502067231801768145627973131066948" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/1025255851584031140335114684223131066948" (Indicator: "paypal.com") "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "tection: 1; mode=blockDC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesVia: 1.1 varnish, 1.1 varnish, 1.1 varnishDate: Mon, 30 Oct 2023 10:44:57 GMTStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Served-By: cache-bur-kbur8200079-BUR, cache-sjc10060-SJC, cache-sjc10060-SJCX-Cache: MISS, MISS, MISSX-Cache-Hits: 0, 0, 0X-Timer: S1698662698.865104,VS0,VE121Vary: Accept-EncodingServer-Timing: "traceparent;desc="00-0000000000000000000f959394e1bd17-dd8579e0745cf11d-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"transfer-encoding: chunked" (Indicator: "paypal.com") "GET /images/shared/icon-PN-check.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ea6/6912cec4d3b20a4b4885100ee0ff3/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKAccept-CH: DPR, Viewport-Width, Width, ECT, DownlinkAccept-Ranges: bytesCache-Control: s-maxage=31536000, public,max-age=3600Content-Type: image/pngDate: Mon, 30 Oct 2023 10:45:02 GMTDC: ccg11-origin-www-1.paypal.comEtag: "60271b47-8bc"Expires: Mon, 30 Oct 2023 11:45:02 GMTLast-Modified: Sat, 13 Feb 2021 00:20:23 GMTPaypal-Debug-Id: e6499f4eb22b3Server: ECAcc (sac/2516)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000e6499f4eb22b3-1288f425f671a41e-01X-Cache: HITX-Content-Type-Options: nosniffContent-Length: 2236" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Headers: x-csrf-tokenAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *Cache-Control: max-age=31536000, s-maxage=31536000Content-Type: application/javascriptDate: Mon, 30 Oct 2023 10:45:02 GMTDC: ccg11-origin-www-1.paypal.comEtag: W/"65317cd0-edf"Expires: Tue, 29 Oct 2024 10:45:02 GMTLast-Modified: Thu, 19 Oct 2023 19:00:32 GMTPaypal-Debug-Id: c4f4747afcb31Server: ECAcc (sac/2571)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000c4f4747afcb31-d07c8965ffb77b07-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 1788" (Indicator: "paypal.com") "HTTP/1.1 200 OKAccept-CH: DPR, Viewport-Width, Width, ECT, DownlinkAccept-Ranges: bytesCache-Control: s-maxage=31536000, public,max-age=3600Content-Type: image/pngDate: Mon, 30 Oct 2023 10:45:02 GMTDC: ccg11-origin-www-1.paypal.comEtag: "54130c54-16c4"Expires: Mon, 30 Oct 2023 11:45:02 GMTLast-Modified: Fri, 12 Sep 2014 15:08:04 GMTPaypal-Debug-Id: cd52faa5009f3Server: ECAcc (sac/250D)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000cd52faa5009f3-0754bfa7100a48fc-01X-Cache: HITX-Content-Type-Options: nosniffContent-Length: 5828" (Indicator: "paypal.com") "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ea6/6912cec4d3b20a4b4885100ee0ff3/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/ea6/6912cec4d3b20a4b4885100ee0ff3/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webcaptcha/ngrlCaptcha.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com")5d:T3078,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Mon 30 Oct 2023 10:43:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Mon 30 Oct 2023 10:43:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 10:26:17 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1093 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 10:25:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1163 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gsr1/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 30 Oct 2023 10:17:28 GMT Expires: Mon 30 Oct 2023 11:07:28 GMT Cache-Control: public max-age=3000 Age: 1623 Last-Modified: Mon 09 Oct 2023 07:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308206C7308205AF020101300D06092A864886F70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Mon 30 Oct 2023 06:37:43 GMT X-Sucuri-ID: 11024 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Sun 29 Oct 2023 19:54:44 GMT Expires: Mon 30 Oct 2023 19:54:44 GMT ETag: "1549b83b8e11f781822ef79c7a44e202c11d093d" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT X-Cache: Hit from cloudfront Via: 1.1 1b76276e9fd9c7bd637ed463cc0a5976.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: 6nI-_5TssYKiPrsxe00w_aq6RuKij0BFzgavsDkjL4bRzTUhMXcIEg== Age: 14809 with response body ==>....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 09:54:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3030 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/fVJxbV-Ktmk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 11341 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 30 Oct 2023 10:14:59 GMT Expires: Mon 30 Oct 2023 11:04:59 GMT Cache-Control: public max-age=3000 Age: 1776 Last-Modified: Mon 30 Oct 2023 08:12:38 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30822C4930822B31020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1548 Connection: keep-alive Date: Mon 30 Oct 2023 10:23:37 GMT Last-Modified: Mon 30 Oct 2023 10:23:37 GMT ETag: 4810504f2419ef4c04541a401c2943793dfa8619 Expires: Mon 06 Nov 2023 10:23:37 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 713 Connection: keep-alive Date: Mon 28 Aug 2023 22:58:20 GMT Last-Modified: Thu 25 May 2023 00:16:41 GMT ETag: "17529b3e2cbd518730e68190e9f121a9" x-amz-server-side-encryption: AES256 Cache-Control: public Expires: Mon 20 May 2024 20:17:36 GMT x-amz-version-id: mXKxEiey0eSLSed3QQI7ZgcwL3M2RGWn Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 b37bef2041652ba1d4a26e5e191fdc70.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-C1 X-Amz-Cf-Id: 9wOBVo69lmYIk-73r4ANMZEdmMCzUQuQ6AQg1g4tOCq6bR2xzAy7VQ== Age: 5399177 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1426 Connection: keep-alive Date: Mon 30 Oct 2023 10:28:36 GMT Last-Modified: Mon 30 Oct 2023 10:28:36 GMT ETag: 8fb331e984901d8665228ff3cf1ecbc3975a1a66 Expires: Mon 06 Nov 2023 10:28:36 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 651 Connection: keep-alive Date: Mon 28 Aug 2023 22:59:01 GMT Last-Modified: Thu 25 May 2023 00:16:34 GMT ETag: "9058c82ab542b2701eb78e0a4e482593" x-amz-server-side-encryption: AES256 Cache-Control: public Expires: Mon 20 May 2024 20:13:06 GMT x-amz-version-id: jp0NT7VkGOm4vGsuA2lczqulWP4uBCNG Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 2cd1423c218193e9646892449fb7844a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-C1 X-Amz-Cf-Id: ssFgl-qOC8CIArbkIQgODg-gf_qfx7FDIMuFrFoMxvbQSfwK6lwSnQ== Age: 5399137 with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m02.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Mon 30 Oct 2023 09:04:24 GMT Server: ECAcc (sac/257E) X-Cache: Hit from cloudfront Via: 1.1 55e9464473b96a5fed56600591202122.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P3 X-Amz-Cf-Id: pYi-Bgc-nILAdx64ptbnV6q9aWV_aaSO8_ixaF6vfm_-K60qK6dqow== Age: 6014 with response body ==>....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 10:41:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 219 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 09:56:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2911 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 10:19:20 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1530 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 10:41:26 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 242 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 30 Oct 2023 10:41:26 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 248 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......5e:T108d,"5hi3ts2.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5hi3ts2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5hi3ts2.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5hi3ts2.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5hi3ts2.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5hi3ts2.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5hi3ts2.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "explothe.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "explothe.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "explothe.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}")5f:T502,"TarF04E.tmp" has type "data" "~DFDD737DDDA1D81D21.TMP" has type "data" "~DFF85A253027F35CD3.TMP" has type "data" "~DF56E1AF1299AF4B41.TMP" has type "data" "~DF999616DA4309047C.TMP" has type "data" "~DF0DFB5C3F0CDB2848.TMP" has type "data" - Location: [%TEMP%\~DF0DFB5C3F0CDB2848.TMP] "~DF970B6AFE25A6E775.TMP" has type "data" - Location: [%TEMP%\~DF970B6AFE25A6E775.TMP] "~DF4E672507422EE74A.TMP" has type "data" "~DF2F42EBF0599D61BF.TMP" has type "data" - Location: [%TEMP%\~DF2F42EBF0599D61BF.TMP] "~DFF5A1D29CABCF4179.TMP" has type "data" - Location: [%TEMP%\~DFF5A1D29CABCF4179.TMP] "~DFBA3C9F44C94C32FC.TMP" has type "data" "~DF6F69F1346B8B7105.TMP" has type "data" - Location: [%TEMP%\~DF6F69F1346B8B7105.TMP] "~DF52881AC236549D31.TMP" has type "data" - Location: [%TEMP%\~DF52881AC236549D31.TMP] "~DF2F364ED6AE7FA37B.TMP" has type "data" "~DFD4E499122C16CD67.TMP" has type "data" "~DF2990387DAD4AE317.TMP" has type "data" - Location: [%TEMP%\~DF2990387DAD4AE317.TMP] "~DFD3B3C1CD58852EDB.TMP" has type "data" "CabEFD0.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" "~DF04D8318F04B2E0E4.TMP" has type "data" - Location: [%TEMP%\~DF04D8318F04B2E0E4.TMP]60:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")61:T421,"6c752b163faa36a307dfe59849216aff.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\vy0yt87.exe" "6c752b163faa36a307dfe59849216aff.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\7ol4gg17.exe" "vY0YT87.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\vh2zk03.exe" "vY0YT87.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\6yj0yy4.exe" "VH2Zk03.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\3pa29ih.exe" "VH2Zk03.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\5hi3ts2.exe" "5hi3ts2.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "5hi3ts2.exe" reads file "c:\windows\system32\shdocvw.dll" "5hi3ts2.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\5hi3ts2.exe" "5hi3ts2.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "5hi3ts2.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "5hi3ts2.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "5hi3ts2.exe" reads file "c:\users\%osuser%\contacts\desktop.ini"62:T41a2,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:kOnbP9OSzudYamyTMcjyDcOHAGnVxw:5kFXaysU6qZewBNgConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywM39W1FTl5IY6TUOpiN_QdHR9ZjGFE0wvKhloo3MWSzEURZSyRY41xSMS3JsTk7KOphe1s HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:2kAi-OomrPA7STsGIM0M5TQxHToGgg:PMi3gA796KnHyPyZ"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzh90KA6tvdSb--BRR6a_Ie4V9hVi5Ui6qR9oY-lOCar5KJy8t4Sh2Bq22djgJUUKA8Ld_fJg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S303006333%3A1698662702345079&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:2kAi-OomrPA7STsGIM0M5TQxHToGgg:PMi3gA796KnHyPyZ"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:xCJ28E6a5b6xPohsCl61x3J7smLy7Q:ce4VWIFqYgG91NFb"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyza5FbDq_lyYokRa3HrgYFyhXuG252qPFiIp-jf6N4bo_mASiB4MItbx5Qx39Vp8Ph3NMpfoA HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:kvIB7sevvOvXbbRaECM_x5CCeNldHg:SUAYAO6xlxAs-5XqConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxxhLWPOUEhKGtPCOLOXhnqlRqivFGn3wko7PCjIxKAaiUmt0PGm2FpxCj58lcGmCLV0CkMhg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1777929127%3A1698662712558992&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:QBpUdEZ1oJSV7usd_Gqwh_XI1gJmjQ:d1slHDaOgwXoQrt-"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:QBpUdEZ1oJSV7usd_Gqwh_XI1gJmjQ:d1slHDaOgwXoQrt-"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-9037938746162069043&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=62930&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S303006333:1698662702345079",null,null,"AVQVeyzh90KA6tvdSb--BRR6a_Ie4V9hVi5Ui6qR9oY-lOCar5KJy8t4Sh2Bq22djgJUUKA8Ld_fJg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:QBpUdEZ1oJSV7usd_Gqwh_XI1gJmjQ:d1slHDaOgwXoQrt-; OTZ=7272976_52_52_123900_48_436380"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-5493245443251681026&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=62961&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-1777929127:1698662712558992",null,null,"AVQVeyxxhLWPOUEhKGtPCOLOXhnqlRqivFGn3wko7PCjIxKAaiUmt0PGm2FpxCj58lcGmCLV0CkMhg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:QBpUdEZ1oJSV7usd_Gqwh_XI1gJmjQ:d1slHDaOgwXoQrt-; OTZ=7272976_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:QBpUdEZ1oJSV7usd_Gqwh_XI1gJmjQ:d1slHDaOgwXoQrt-; OTZ=7272976_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:8CuDkC7PVajH5mWE_d6flLP1tZqR8w:C83KirCaAZCg56H3; OTZ=7272976_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /restart?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S303006333%3A1698662702345079&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzh90KA6tvdSb--BRR6a_Ie4V9hVi5Ui6qR9oY-lOCar5KJy8t4Sh2Bq22djgJUUKA8Ld_fJg&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:wwzhhJzfKHtbOsEJK6FjRQ7Nt0qJCA:g3zU_kSNqUjQ_cxe; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzh90KA6tvdSb--BRR6a_Ie4V9hVi5Ui6qR9oY-lOCar5KJy8t4Sh2Bq22djgJUUKA8Ld_fJg&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:WB5o2tfQcXBLjGfnkD-MXCCJ34anvQ:kxM1XonbmgrBvNRP; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vhoConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyzh90KA6tvdSb--BRR6a_Ie4V9hVi5Ui6qR9oY-lOCar5KJy8t4Sh2Bq22djgJUUKA8Ld_fJg&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:WB5o2tfQcXBLjGfnkD-MXCCJ34anvQ:kxM1XonbmgrBvNRP; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeywqgKGh8Eqo6zpGK8tp_SrqKD5SOyHkEbo0bDAU4pxIr8h_VEsOv4tama3qXMD3MsE36lfmHw&theme=glif&dsh=S-469688749%3A1698662793943780 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:WB5o2tfQcXBLjGfnkD-MXCCJ34anvQ:kxM1XonbmgrBvNRP; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:XFOF3hRQbNuvUT-BRKL4V5r0fnvENg:8PYWTIUpA9rb65B4; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxxhLWPOUEhKGtPCOLOXhnqlRqivFGn3wko7PCjIxKAaiUmt0PGm2FpxCj58lcGmCLV0CkMhg&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:rAOGf04u9U0UFHbIE1wPKXjbbYGAeg:f8lE_mOWiRwPujdh; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vhoConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyxxhLWPOUEhKGtPCOLOXhnqlRqivFGn3wko7PCjIxKAaiUmt0PGm2FpxCj58lcGmCLV0CkMhg&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:UaHj6J2JR5sZCvMWfMruNmlfBNpY5A:fLFwNBLPN3IJ-vne; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzQjfoQUG7RPEX3mtXZ_zMDBgrLt5iM29BXTLT03-N-ptzZaIqbfXMq77JdlJ-Vci3V6U9eJg&theme=glif&dsh=S-771606468%3A1698662799630575 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:UaHj6J2JR5sZCvMWfMruNmlfBNpY5A:fLFwNBLPN3IJ-vne; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:UaHj6J2JR5sZCvMWfMruNmlfBNpY5A:fLFwNBLPN3IJ-vne; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=6608163073505295876&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=83544&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-469688749:1698662793943780",null,null,"AVQVeywqgKGh8Eqo6zpGK8tp_SrqKD5SOyHkEbo0bDAU4pxIr8h_VEsOv4tama3qXMD3MsE36lfmHw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:UaHj6J2JR5sZCvMWfMruNmlfBNpY5A:fLFwNBLPN3IJ-vne; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:UaHj6J2JR5sZCvMWfMruNmlfBNpY5A:fLFwNBLPN3IJ-vne; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-9075338989119606401&bl=boq_identityfrontendauthuiserver_20231022.06_p0&hl=en-US&_reqid=84491&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-771606468:1698662799630575",null,null,"AVQVeyzQjfoQUG7RPEX3mtXZ_zMDBgrLt5iM29BXTLT03-N-ptzZaIqbfXMq77JdlJ-Vci3V6U9eJg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:EM5gPZ-qROg-dq1rxtmtVEXn4iti_g:TlrvyJ_F2GAMFfe4; OTZ=7272976_52_52_123900_48_436380; NID=511=W4XQ8ApH67_fGKGY8WvTi4xoUNIebvbMZ77XoGwJ0MyXxgq6DEIWM0HZbsohmUMaJNeUCr2c1Q1QsR2TXQAxy2dFJ7cuLeUrsYO8FVqAQTw6vYtNlcNAZazQWeeTbtuoSnX8qDT2N5VgC62g1McG0jy33VymlroeDSV7a6J-vho"; in File: "SSL") Found requests in header "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.epicgames.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL")63:T49b,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003000-00000C26-51697237") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003000-00000C26-51699585") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002268.00000000.73334.001DC000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002268.00000000.73334.001DC000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002268.00000000.73334.001DC000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002268.00000000.73334.001DC000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002268.00000000.73334.001DC000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002268.00000000.73334.001DC000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002268.00000000.73334.001DC000.00000002.mdmp")64:T478,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00000824.00000000.68371.00417000.00000004.mdmp, 00000000-00000824.00000002.70990.00417000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00000824.00000000.68371.00417000.00000004.mdmp, 00000000-00000824.00000002.70990.00417000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002268.00000000.73334.001DC000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002456.00000000.66746.002F0000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002988.00000000.66663.000D0000.00000004.mdmp, 00000000-00002988.00000001.68582.000D0000.00000004.mdmp, 00000000-00002988.00000003.71073.000D0000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00002988.00000000.66663.000D0000.00000004.mdmp, 00000000-00002988.00000001.68582.000D0000.00000004.mdmp, 00000000-00002988.00000003.71073.000D0000.00000004.mdmp")65:Ta434,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:kOnbP9OSzudYamyTMcjyDcOHAGnVxw:5kFXaysU6qZewBNg;Path=/;Expires=Wed, 29-Oct-2025 10:44:57 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-xiWmDBZPpDgVULuMkLhmqw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon, 30 Oct 2023 10:44:57 GMTExpires: Mon, 30 Oct 2023 10:44:57 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j00000001�000000010000001dc��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comCookie: __Host-GAPS=1:kOnbP9OSzudYamyTMcjyDcOHAGnVxw:5kFXaysU6qZewBNgConnection: Keep-AliveDNT: 1", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:2kAi-OomrPA7STsGIM0M5TQxHToGgg:PMi3gA796KnHyPyZ; Expires=Wed 29-Oct-2025 10:45:02 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 30 Oct 2023 10:45:02 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywM39W1FTl5IY6TUOpiN_QdHR9ZjGFE0wvKhloo3MWSzEURZSyRY41xSMS3JsTk7KOphe1sStrict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Cross-Origin-Opener-Policy: unsafe-noneCross-Origin-Resource-Policy: cross-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-lEVGSntpvni20OCqeVecWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywM39W1FTl5IY6TUOpiN_QdHR9ZjGFE0wvKhloo3MWSzEURZSyRY41xSMS3JsTk7KOphe1s HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:2kAi-OomrPA7STsGIM0M5TQxHToGgg:PMi3gA796KnHyPyZ", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzh90KA6tvdSb--BRR6a_Ie4V9hVi5Ui6qR9oY-lOCar5KJy8t4Sh2Bq22djgJUUKA8Ld_fJg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S303006333%3A1698662702345079&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:2kAi-OomrPA7STsGIM0M5TQxHToGgg:PMi3gA796KnHyPyZ", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Mon 30 Oct 2023 10:45:02 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzh90KA6tvdSb--BRR6a_Ie4V9hVi5Ui6qR9oY-lOCar5KJy8t4Sh2Bq22djgJUUKA8Ld_fJg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S303006333%3A1698662702345079&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-2n-Vu0NK9kNgaMjpXaqadg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Report-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�000000010000000100000001000000010000000100000001000000010000000100000001�00000001R00000001M00000001o00000001�00000001@0000000100000001�00000001�00000001+0000000100169��)+(J6h�Kh�� "_��]��C'��{/3y�.܍9n�Cf��tMc��5�IFs/'�Y��*�'��̧�i�7k��\��eO��RcՖ��_%��.ip��-lc��,��A<ߧUZ݈�(��O��D)I0:�O>eYZ��0ے�g��꽗d�!�c�Ue�g��XAk].��9v:ۖ��;��`K䓭�}'��^>X�Σ��`qr��#Zm�k}d�p5��W��'"EF�:��K@��$|��6^�-#-��@^L�k+(��HHBH�$��ԓ��,�C$J�*��#&̏1��ܽ�ڸ��\�" "0000000100000001�000000010000000100000001000000010000000100000001000000011�1b0a�=�w�ҿ��6�bb��@�{d�dOH ��x��o��I6��C��~�ݞli43ͦ��,�35Q��h��)��{�4ҙ�V:%)V=�:V:/��m!��;�iWwwyQ4��c�z��SQN4��Qa�Vz��H9|J�5TO�@dY�J�DCw��ӆ��l�RL'%��(R=��I�n�"�+�*m��y�oK��`�W��m�ϱ�K�8�i~��TC��.��f�#]�x��t:�>2�TNWe^�Q6}|�MR��5��W�{6}"Y'g��}��_��\9ϖ��b��4G��ʢ�Ҿ�vw� Z��w�n>><��=@�XC�py�'�C�W ~95ؙKt<��M�&�?t��r&�tV�/e"�s��X�\(�\y�R.��|�Xb��ŖO-W��Ev�R��J�d��N��y��|�n>��r�銇��C[,cyܷ��6�5��ׯ�PU�_�K�W.qY�N�I��A��M�dN��K��]�oj�x��^��x;8�C~�|;w'J��/Ł?��c��@E��?��-�^��ftZ�n��)��F�3��W��H�)�@�l��>��"�i�xۏkO�X��\m(d�r�P�̲߳yx)e�YP4��yB�o_�0�F�oM��ל��3��T��CDY��a�`��#�Q��EU��@��K7t9O��n�h]�h��z`=p��4��O[� �n�qyq��v��k�=�Q睡E��2�P��Ap4S��Y5��Q��׆�#C�ݦMd��P�k��>t_L��$��OD9A�E>e��ױ�X��"�^��b��V�k�N��N��=�|�)�}P��]��D�T&�4�7�NZ�#��|��Jl )�S��s)k��>(=�[Dm�:��.��&�_�}�]��oM�Ѷǒ�l�[S��i;�6��s��S��6o�[�Oä��H�t��!XA�}%:�>/ز��~�y�7chycl��d�է�:��C��\��*��x�ťA�k9��}�lA�I@��%��e1){��[h;��|ȯ��8�_�e0<��Pfn}��.l��s�*r�M��z�qT�}�Fӗ�>{�(;#�%0��]��6Q��o+��|�o<1��!o��Ϧ��y�G��Q��Y�5�=��Ibɻ��B�Ak��ǡK��$��L��;��]L�$�'O� �z7O��8A�Bxͦ�Ǎ��ӗw�S��h�c9��xOP̳ٴsg�\��A(�9<��8�頏�h�t.��BS��#^��ֹڙ��:V�{�mg<.M��Fs`�h��g�z �n�xj?O4~��0�wOB��ݜ5^&e��O�7{�|�A'z"q�o�M�dt��',��~uwI��h��A[*r��2�Q_8;}9��|"��س��@�P��(߱n,�^�v�q�k��?>��kL�@{�h�E��&/7��K�pO��W?��8�V�W?/8�$G�;�2��O�'�gZ��r�?#�<��\�C1��c_k��|_�f'�#ub�;��oCؤێ��o5�)�N7�Y��Ld�8��Z�dj�]�]�H�]b�]G��铔Ӎ��*y�FE�-�r:?Rz<��"aaUGU�y쥀��B�:�9~�w'S��8u�dr���|��23E��Hy��c�N��@��K��#3��p��1�`� �`�}�O;0եf��3s'��0��W�&��o�ȅ�t�D�U��e�� )Y��P��(C�I�ö�t毿"��}��L��za�}@��K��O|NМ˲�#P��kM�*|_҄�9��;�o�� LM��E�ʊ��;E��R-��P<�$j��l��^�^��̾��I��U*}C?��:_��b+��[�ǚ��r�C gV�RRlH��R��BNB2�v[Ac�h�O2^�CC3A2R�]�� l�5'@F��;@�k+�Ӈw�K�ޒ4�0Ǌ��̂�0�}��!�6�A��O��~}��X��T$;��}��eX�͎a��On+�d��ϙf��嗢� 6C�M�J��w@U հ>�wL�3�>��聐W��8ǲ��u��Q��t<��MC�#��u"3��]Yt��n^��&�=�30Q�H�b��<��kG�c�#��Ac��~d��@HAB�k��s�.�C��k��s�Yv�v|�XDp�� 3�݄��p�0V^�f�}��#`PiZx}��fr"��;N_�3��ԝ��oQ�-�i��$�']0�;c|��z�7�xf��P.�&�D�|183�l��59.wM�#Fch��1zU��q�k��g��X��Myrvy�)I�ټѴ��Q�{4��㉈L�զfN�2�)T{��;�pk��H��fۻ�A��Or��G�m{p��7�]e*�^��z��^cW�s��;��G��~��{:7n�îy��ӳ�JoW�/j]#�zٮ��:�hokr��r�C��L�e�[��"J3��^ѫD&��z�lf��b�K{r��}�h>�� (�/�;�ř{��?��dMj�", "U�EsR�1��)�ETE��5w�|ZQ�,܍�3$Jy�s睫�Sq�"凎Q��1��e�y��לy/4ҌWa��A��R�੐��Z�3')�P)��(��i�@{�*��)��`]�� R��9a=6R��Z�e��y�<��L�r��\��j��)A�VF��i�P@_s�ʈ��^��;��~�c��gp&@GEp�i1��/Rc"��Y�+e�|�5�t�T��̿6H��}8ޅWG4��x�D8�j�}��DS9(��T� ة�!�;C��>h��lƱx��x�<�$g�)��f�L�g�v�\>SK��Q��Ɛ��k�}�@4�o��w�hj\��>�4L^�ʻ�$�NqA�[1�;Ȭy5f#��l��#��C��Y��x�,�A.�N��x$ͨG��-r��4��B�U��ƪ��v��cs*,��H[Y�Mc��Q�~�6R�z�xo��k�2g�0c�qd��*�@ʱ�0"nȂ_�� ej#��r4h!9hi�X��K�� ӎD��e�%��ꉲXYx{��~��^h�±p��H��hL�@x�c�&4}�qtucO��Ԧ�bx��Et#]��V`�͐6��{hɼ��&�K�X�+�7�d��͑|��r��W��hK!CW��h��9��=��i)��4�B�R��!��b�R��8��6�#�c@:�{vVx�df�#��1N�o��ֹ�͍��ÙgP��B)�>^B�e[�*�Lg��/��?']^�(�;iI�N"JrA�b�(��(J��I"(�i��{�Quh3��c)��ja�eh��Uq(( '�[!HÊY6�X�_�"M��$6葉0�f��Ot�)��)�%�(X�3ކ��^+7Y�X*l�y+��x/Q��>�0q�~nD}Ak,$Wm��H��>��H��xF�%Ya��n|��R��t�[j�Vĸ��XQUF��zU�:�u��AtX8�"�1Z��z�* @"��!ϖ��qWa�P�K��A�hSf��"��cF�I��S\I�Stѳ/z��`�﬽0��t��;X��]��]�*Ԩuni>Ϩ�AR��7a�N�*��<�!��л�n�rs��Xe�;�Ǐ��ruy�`|I�+C��ԉ[7[7��$F=��\�sWU]�R�|Y�Iq ��=K�4��[X�"Q�@YJ͗z��&��}c��H��G��E�m�/��DTIx]Ef��o)j�K�5�|kέ\��ņ�mD�bId�C X�C�u�K��]�� =N!�;�Y�_X��-�.1@��x�>v)�LD6�E�I��y�e�9��zC@H.��M�o|F�s�y4��uR�g'Y�*��rD��HC�Fi��'��1;��71.�J�1y��x��zs��$�跙�i!;�" "?K��T�!8�Vۑ�?p�|q��u_r�-�� +�7��|��7�� o\�w��ˉK^��d��v��z�5L��j/YEx�K�$)S��_֪�q��p�JJ�=<�I�1�Orۘ�+�E�|1�'+o/��4x��`��-�|U6U0')�3e�W�R~g��d��Q�h-.��*-��T"o�O.��h^�:�0�MB�Q1*��Aj�ͣ�+�-�T��q*�»*�v�͑j-��U��Q�*f�+�2$:o�W��a�xcĊC�]�Jno��Y � S�a��C��P3C�y�Ww��L�w�(�T�%��x��,S�Ht/�A|#��o��fJ>�}%]��ퟘ0��k�7)M�Fn�m��9ۈ<�ܴ��F%͐ȶ�9�ȏ(w�Rx��çfS)41��9�O�ˤ�/A��^"M�r��ۦ��[�qH6M9��c��&��Dݷ�7�#]��u1%��8�??'�L�<�c=�y��B��|y1�//��Û�4�ӧ��=�j��n`oX�n�9b;��;��ŝl�P��H�s/��z��ym�`6��ym�$��?��" "00000001�0000000100000001�00000001r00000001�00000001�00000001�00000001W00000001<00000001�00000001�00000001h00000001�00000001�00000001�00000001�00000001b01�bdcj�P�Y|��Yn�v��hk��X��K �Xmi��qDg�r'�;=֑e�\X��R�a��G<�>d��&x��V�i��s�F~��!n��%B�c�M2*�N.y-1}�r�S��0��6�NŠ��p�-�E~|V�o��m�Zb�1��i(AKPE{IϨm8|�2P+��9ʠ<��G��|��*��l�_��ҬTu�|_?�~��>/��!�qQ�]�t�}�.O�Zz�A��l^�F1,��*�G�l��Y��h9{7��dͭ��D@��%[ 5�M�Q��i�!�݊�E��G5�ŕXJv Z��W8��C�j�۔��e�Se�iU8��I��'ϧ��z<��<*��.<*Y��ng[��ݒ�S��X��ċ�o;A�%��RKb30d��}�@�M�Jb%��s�v�V�g.��S�%�0^�d�㛴s�`oj0�s9�n�1ַ F��(��{F��q�[u`E8RĤ �Ry�spD�-AO=�{�(ThX)�|b�k^��C5j�s��B5p��f̑�j ��q?}\�b�z��.�2��z��#Ӻ��^�|�3��B��[��v��ig85r�I?��.�3]�$�U��$׏��Z��ppD��Q[Sni�hah��z��=�,f��J�X�ڱ�O�%k�FÐ��650�r��k`��/Pc�XЏ�/�Se��_Q��_", "�9��C<�a�t�!D��wn�mp�60�U��y2�Z�Ö1�b�� B/�˾��d�l0��.�h��}b�tg�V�� =�5]o��?M��2�e6�2��t44��-Ş�'_/�.��Γ��֛.�� ߹�3%��Y��S�hPO�6�}�+��?m>^�et�v~Y^~��A5��e�.�v��oօSO��N�Yi�k֣�N��yg2��j��G�.��(8��>��ɏ�u�tRm<�v�A}�NN��>��5�Y��(Q��"�A��E� #[��r|�u%Ц��z�,��ߧgG��=,��Z��J35��<~N]>�r��\(��қ�/�Ι�ߥ��u�Wtc�S��#��a��:�6<��Њzk?jb0��GG��Xw&��x��l�c��E��v/��k��k��2��{Uٚt��4+h��a�7X�ت��*�9K��<�pzb�o��u~��?:�{��p9��n�Ziw�??��v��컵��,�㲝�5�oQ�ՖW�m��ʺ6��}g$6�>��;�u��2��E��C}N��>��| A�Gg��i@��8y�AMߒ�ۚt=g�NHz��GSͧ��O]y� R��18[l�~��vFK4<(,>r�c��jO�t�R��/�O&NU$lU��p��}B��<[�<؏��n��ک�"P��\��[ioV<��f��~�d�Ѹ��`��w��#K��P��t�+�;��x��ۻ#C^�O��Nv��c�k��Ƀ��'}>6��i??��&�91f5k/W꙲�}q��ӗ�D�%`듓Fl��@��-��4��6�X�B&�c]�a.~�c�k}_~ե1jg��\�_�|��r��S�|�#I+��L:�H[�m��}��M�~��-�ٿ}�/��Rc~��b2#�{k9�3�kڿn��,��^��6�J��'�NC�F��w� a�|;��m[�-��Wv��丼T�A~4zL.%��#�.��%�%=�.��P��U��", "00000001 00000001f00000001_00000001Q00000001�00000001�00000001�00000001�0880b)�'FQ�r��)j�_dk�U3aC�m,;�Rzm@��e��Sy�ʚ�ujhc�%��L�F��6"'�{I�=QgS +�;�s�.��v�Ǥ� e^D��ȓ��Z��|�/t��id��p�1��Ŭ�#��ڳ�{�{�Y�w%��0cﻑ�|��8�;`ө̑y%}�F��(`u��#��H��ښ��V^Gu��!��ތ��S��xS��o��m�'�n��:��?h��Gǝ��7�0a G�ݽ;�Lg�=?�/�OY��J�J�:E�[�LUu6g��e6`a�M'��˫��QB뿽֑ǔFtݽ:<ίz71R�4��g/��G�'�L��o>Ǡ��Q-4�U�7撷A�6WZV��2�@1�EX�~�G��[�-�NiP�A25T2X��Sy�cMA�A��**(�=u#6 ےS$nw�8��(�\,�/"t"ˀA��dj��L�M6%G�3R�C��t�h��G��ml�h��ڸ��(Ѥma�:�&"h[�Wٍ��9�j�D;Z�"4C��!�"��{Ǹ�9�ԉ�L'�h��,ا�s�5х�QΆܿ��ܽ(w��&^�y��С'��Y�Eм��D�j�b2|P��f0�x��3'�ډ??��0=��0�a�J�V}��F�>��5Hs�Mp5��bAhz�q�jS�Q�wC�N��Z�pp�چ�pb�B��&��6^�d�?��Z�e�NrXʝM-�ѝ5=z��X��n|�[��1��ge�P��X�K>��߼|yQG+�p�~/�W�P��H\��\�-9��tm�k�ZZ�B��zEݑ��_+�d�^��а`��K�n��ё��"�Sԑ��w�2m�Rejc;�z(��xx�&>"��[,��]@�;�q��=S~\�N_�1vb��#h7R|�,lB3NDF�D��a�1�#��ά��k��\�P�LQ�=/_nj�lM�˼�$(��4��F��Pz}3�G�r|�xW`�CSP�B�AL��9�%/ ;_[�aD=�&�_y&��.d��d��MDՐ��\��qG]�4η�3g��"qa�R��h$9�L0�1��֌��i��E�qe��YW�gIr{l��,�Y�TR�x�ёu�BU��r��\+��y��:Ψ��Y�M�VUd\m��AҢ", "�m��mF6M\�kR}��)[�7f��)K�S@�!C\`}��W�*�Y�}��iy4$c.�6�s�LWF�O�� W(�>��9,-��U�fԼ��H��RL�Y�6}e�|�絅&��w��f�I2~h�2#��\��_�bN��Z�1͋2��̋�P!��F�D-�Ȏ/�Hr�k4�s��~m>��O-�CA^��a�/B�Zɲ�/��݊�Y�B<��q5BX=��BAU�:3�ۜ��~�w;p5�8��Wϕ+�F1g�/��[��W��s&��@��[�|r?�>L$��J�'��lV��5�$P&<��U��Q�<�K,MU+�E5�k�u�4��(32��i��O喂W�&p��s��?�׬l�+D��wX��y��:u�#se��XLSM��ȕr��)/��7��bu9U֟[JZK��0l��h�j��sÙ��o��I��窱�pp��|/��d]aY��r/��r��E�3@B��֖�{�Z�+��Hٝ�ב��IL�ȀU��Y�o��g4��%��hk�Q{g�q��ͳ��WU\UO<��'HM��6um%��j݀��"�*|X�_��@��;/��^U{�pg�Ɗ�u*�κ�t��=�R֋'-u#OV<�@�2yb��2m/��ljX%C=�)d�Sɂꏡ��:aC^�tRwҫ�PCY�w�s`��4�e^B��JQ�I+�9��@R�G��q��p�1��r�uf�C�Q��N��u�� ˲�}#�bFHX͠;>3�I�-�^�L��{A��@+b3�m�0�^]gQ;��˜�T��", "00000001�00000001}00000001{00000001s0000000100000001I00000001�00000001�00000001W0000000100000001900000001�00000001�00000001V00000001�00000001�00000001�0000000100000001<1286c��6v��-{�`��H�d[�-�ج@��dVeVW5��wύ��^��_f��h[R��FD3ul��v��9��7I��_�F�\�4�'�k�5=�ǅ�D�e��F#��r��-�m��K�[Q��e�Z��E�1�20�w<��}�Gl�_�$�2�5k�Z��u��a"�li2@�,�!4��jU2r ��s�?H�ۆRba��*��i��BAc�Z�V��k��f^He_�?cX��`��u��^��nU�Î�Hw�L��=P��d�I�sfE��h�q��0l�LU�r8ںOjc�y׻L��9�I�s�� W�+��d��/��j�_�urA�rߝͶ��D��m~u��O��3Oy��i�cP�8l��"[�mCA"�s�7ڂЉ��̜�c��Na��au7��$��E��>��+��]��IC��v��x�e��>��͹0�X��e��e\�O]�{��9�N�t�NE\K��ǓB�", "�-M��UZ�W��G��X�<�o��1��d�d�|�o~��J6a�I��B�Z^E f�{��V�ſ��j��!RYT��LܥZ��a#�+��x�2or8�_64�+M�X\��jP��7�P�X��U�z�?�c_�r�aW�dSa��Y��z�U��k��;�N�?h��l2ly\w�$͛�1�|��oN��CT ;z��ϞO��%R3�](�A˛�i:�ۄN2�3@��*lCw��ąH,�ʴOƇT^��o*kJѮV2Ém��X a"ɢ�֍J{�Gn�j��H�r˦=�t��~Y��ЩyC�8f��"�=��FE�Q�IЬ��{K�L;ꗊ�$EQ��`}7�ՙ(��X�xo��'�ᴷQ6B}�G�x��0#�9V�Ou i�~�U��8��;��Ι8Fx@��!>�1ݿ'b�xO�7qP�Jf�@�o��}�Z�Ϡȭj��e��X��O��o��*~�RG�z��ؓS4�dio�F�I��;��s�AAդ��K:�7��۳O�O�0��TX|��v�x�[2��H��!^�s��)l��5�1=�m��j�5t��W��B\��9p�.�C��<�Kk��u��T��(a�$��wh�~��]q��|��t��|��*��ߊ3;�K��1*"�Gگ8��S|�M��XI��bT�|�YA*�LE��>*Hee��VRG��C��2/O�F"j"hm��cV\im.��0��4v��8D�ϧ^I�b膩�r8V愩8g�Y[�b��Ĩ<8G��OŨ�(He�x-e��*͙_.��:�S��\̩��.HjV'O��3��Cj��r$S5�DHv��ˁ�.��ĝ�1�:��G�Wt&:{�Z�%�z��#ʺ�Y��p��2Y�"��y2��Z��t=�.��4V1�S5��0EIC��6p��M��_;��I�0v", "b�u�M��%��`��D��62��.�c�q��$:�{��*�D��7S��c�l�l�p�D�cI�T�+�� Ŕ��) ![ax+�;�Zv�@}�(�c��`@OX�P3��1v�m��@KC.�B�{q�='^{��&W�[��!��l�q*�`�=��S��Ń��0��¯�c:NS}}��hz��u9ג��MMP��a�{D��GP�׻�.�΍�:��y��3G_h͎��@_!g�˗_�W��kୟ��U�fӹ�$hCMj��2�l�Ps=g��z��`��-%,V��<��qh�Q�R69G,}eeK��-�u��n�UD��Z�xhv$B��mи�t��Y��r<�y� �qRS��1��[2)�߂�7]��x[�V fR��W��X�o�Ռ�`%��3��f�S[�� _!��1��X��j�� <�d�B)�ϥ�8]|."��ru�+��w�"�3��a<��(X��b%0��`V_p�T�Y!�^qe|��?�p<�Z��H��&f�W��"2r��u��/�E�A��"A/+>1��;��R(��K�l9wN�<9e-�0@F��*;*'��G�rpmҟ*x�_P�\��E�/ރG��3P�1��f�܉Ɨ��[�렣)Ms�x�U*�MG��#%�i�ҵ+�N+�r�WTs�?%(�&�T�t*��\ե��W6+p�Ka��؉>�΢߰�ȭwQ>n��3�U<��,�z�:ӱ�{U�&�HE�N�L4u|��ИC��J��~j�j9�Xb�1{Kׂ�,��66��ˋ�Z{x8�[��Y�~�b��P �`�t��R$�X��Z�Hhb�k[�o��c��e��C�Z4/|NRZ#�%��ϳo��|�eeg�u9��U*c�{i�9��'��F�A\̕ct��9��%��U�x��@��MB}o�er�<� �L��߿׮R��/��Rkۏ��6+g�q-��K��;<Ԩ~.2�%;�5�8��J�d�8.��v�.�&-ٝ�@�f2�:��!}T��Ѭ�t�81]},.�~��Rr�PI9�W�=�d�e��sw�H�ďC��ۍ��x��Eh\��\\��%�9иv�r��&�v:��w��?�1dF��t\;�y|��}T]��vq37�n�yy�9�,��GK�,�ࣨ2��D~^�o]Ai��ō��3��/7�?n�ů�ή8��_��u�ࣳklc�ӳ��ڙ�r�", "e��3��hz�֊VY��=��({vXw<�ZxX��5�4\��T��})$=d�0��e�r$�RJ-G)D3��H@�'��j��^bT�ha^ևe�=�Y�/[p�P&�BBa��d�XM�{�v[a<�}�-X��/*��Z�y�qC��&I��a��I��4��uH9��Ffe��7@m��̶dS6<鎲��W�KВ8,ʄ��h�w!��I�I[8N]:"��%}�Lr>�uY��9�ML^��?��u��E�uW�l�G�ga�[��,��1ME��`�� 4X��J� 7��fȶz]��s��g�c�YY^��e�J9�@�a��{t�EO;��8��2�x�k��:��{�=��+�5U��gh�z��9C�a�]��#⸪]: ��#�y]�xl?~z��3��^�va��oE�[sh�ӷ�KG��Nb��W,��O��G��=��c��۵z��oW�G�N�/UDWG�Y��`'��Vyq�NY��"�rt�f[�O��u'�&��~K�ѦG�?�0��>@��c{*lۊ8��iuV�gL��C�Y�r�Ԭ��m�z7T�2�rɌe+�ܒb��̇wc��~I��D��E�g}��'�e�B_0�a5��;�g4��gmA��3!T�Z�r�}Aahm�M5خ�[��)EZ�rZ�e\O�`�G��^�}�_��1rb�-�3߱�fL�g��a��*�z1��D�eK�/��ɗ�}�_��I5~p�%Ny�y��/-T��EI��Y孞L�}i�ٗ��i��JL�B�J��HS��$��vJ��%kTiٗ�o�S��Cs~R�<�}��j)�(�?�Mb��gyF��zF՗�]�ֱr��A��u�H1s�b��WbH�8C��X��M��I�s|�ﺬ�]�Ti��yg�2�b;�^�v[KH-ÐT�6��s��L?�L��=dHK^f��3�kq'��D�v(G+d�/�c��n��k��^@��q�SN��ț�ҍ-�|�F�v}8|u��E4��݈u6��*��4+��Y��&��o�jզsXbY\Wغ�J?հ�̃��% ��H��tT5�Q�C��c�̈́�=�%�,/�h�.e�),��^;�ڻz��:�s$�ZdQ|@J��*��Š%1��k�wQrզ#�8}�Nu��l�Y��|;��w��ܜ�xj DN�D��'��?a�Ա��$��)�j��,�+��J-6��/�" "ce�f�3�(�.�YS�J�-pn�n@ J6�]_J/#E�q# 5��rF�,8Y�Ya��t�]"��!e��i��;6�� AE�9nZd��LeT��o}'䴮)��48&��aX��B8EÐ"��4�A�ک3=%�J�WvN�y�7�Tzo��_��D�ٹ��N�\ҷ�!'k��(+�٪�q�o��vm�?�7X;6�&��Ռ� =P,�K��ML:�c��W��)�+8G�>2`�ь��Q�� ֮�Ӗ��W=��䯡$��Zx��ŬT[<��¡��uyGIV��!Ye�bV�~iVY�+O�I��V��T\�u��ZzA�?�XAp��\�շkf�=�=(*�w��Q��7Ǭ��W;#��"�Zx �8�<��a�3��͔��Vw�ҟrk�J:�Y��ܿ9sQ�.�=t[��=��rh4��I2Vx��E�줒��iM�HijADS�社��3M�4eiJ�� UA^QZT1�n�O1��ml�П�bv3NO֍�-9ea��r�}�8�U��~�f4�D��B~y�EP�9�Ho��*vQ��)�hm��|B�s?g�/�v��OBp�>A�=mm�l�d�5y�օ]�Fe��|� ��)��?�)��[�״Өm��E��%�nu�p�}��{歇��ʔ�Շ��fG3s�忰�Ylv43GT@َf��;��}��/�w�"��}~^�p��pK��U�]yHR��D�%,7��C��x�"/k�'��.��!��t�8�%�_�9��g$��e�J,]{o'q�>u�S�n�e��g&��~�Qb��4��`Q�F��t�7�", "Ek5�*%��f8��f9]noMLզ��ЯK�5!�m�� @��VY�.̹)�wK��r�bo�\�'��Z��ߖ��Z�#w^H�^`�O(�F�r'�5|8�D&0�n�)ꤴ(Z.f�Z~��A�؊UɫM�U"�f��z�!�6�C��z7֑V��;}X�55��O�P�\1ػ%��WԱ�/yc�~�*��Po�K��㬙kأIS;��=)�t��Ǡ�}��1v�\��O=N��+w޹�ʶ��il<��7�Q�F��e0��#.?�!�(�*w��_k�)È�T��X"p)��Ϣ�Q�c��AcrX�˷�8�sڷ�fٽ�ڻ}�)�D��M>�'8Č�$ѝR�)��t"��.��k�G�2oh��rDT��Wp�a��0Y-��&:��l��{.�r�g��8u ��\��G�1�Nc� ��sh�F��5��_�GA��߄v�)?��*�� |ڹ�M��z��i��E��S��=<��7��˟~+#�\ x&�3�s��UŃe��lg^s4G'��;Z$�<��2c��^�#ȃuE��:��{ۅc��9��l��M$L�ٿޞ#Z�$W�d�U�]/e��)��M��IP�Lj�f<�%q8�F�.�I�(5/�'9}.ݗ��y.a�@JI���_��x)�p��\g)��L�s\=��V:*��G^C��r��\:��s��r�&�g��:S�W��F/L��Qlׁ�P��2wMd{mpam�yB�_u�S�ճK�U��O8s�g�Us�:�pv��6<��#��.��3��Iv3��"��@kC��&��z�1#�B��Fb�G3Gx}��_ֽ_�չ�F�k��C�fD�h�x$�1~Ъ@Q�m��\��q��5�⌲��Dڜ��O0��Ƅ��E��[��I" "ǿ�ߗ��ȷz�he�,�w��Cs{bkiu�C��ӎ��LϚ��9�2��{��x�g.�C/Χ�L�"�ShՕ�$7��CV�+ͣ�Ky�9�0��Td��T��ɕa��d�gs��U9� M�g��X`=R<�A�.�OV�/��j��iRN�8�yfS�=@9i!9�HC��/��c��5k��*�A�v��+��*��[�2�a��f�Z��E^B{��bG��=w&a�l�ȗ��\.T>Q��D[MO��eC�|�a��-�w.q4|��y�xi2�זgH��K��b.y��t+U�W;8� }*�a�o��fU��2r��ѣ�ٟ�R��C�w��)M��b�$a��D$/ȶ_��I0��:��-��"��?C��j,jY��Vk(��z�n7�A4��Y,��g�ޟ�ݨ��/�ݖТw�I�%4�$P#��!�>��j�{��4y��o�w�H��٢A�q��johU�;6��킏�h��U�]o1�O��K��;�`�y��w~,B�A�.#i��G�V��x��)�7r�KƮS�Db*�g�Q��L��ZZ,��2�p��.�<��Y��"1\��C�N�ٍ�s�)g��rNJ(�!�@9Ʋ�R�R�p�rxg0��E)��D��i��A�8wa�*��G��(z�s�ZD7ǁ��;D��H+�M��Oy.�0��Y�B�g��z��ͣ�6�w��<'��s��"H��f��5�E�܎s!��<��3%$�\+nX�aA�`�#��y� Edp/D��y��{��J�/׸��@�ʕyF�K�.N��\�,o�0��C~�VX�يD\�Z/O��ŕC#�,��%��#��F(�'��K��z�w~�w��fa��S�k�ҵ��qw�Ʀ��^��^W��8K��L��tF_Y��S>#݁f��NWA�ANF��|��At��V�h��t�L��mXq"B�'��D�0��=f4�Q��w��n�K�z�>�$l��}�a��ҢAK<6��u�Z�C��ξ��0D�VY��K�[h��Jk�!ָ��^��*`�Ճr�LZ�6֚�%Z�h8��yin7��^��/�Г��x�.�U��k\T��dS�vS��B��$�f��>URm�n�", "p�L29�J�Լ�;aӳ4�9QWۘ�\��yL�4��O��Cx.x;�K��d>YL�Jk�i=�ia��]�@_�%Z��'�}{�i��2��Ą��e?�V4��l��ؠ�sDS)��C{�I4�O�F2F�sO�h�S�-!̫�X��&�K֞�>��er��6�܂Hd��m��5.ϼ;��U��w�"��S��j`��t`�٤j�|�V�z�*��d��J�'2h4�~X��*��U�]��{�6��~�d��,>��7��KҼ�Bl��6~&9�z4qS��M��M�87�V�;8JT�O�d�OEە4�+i*��)�^d��3�2_cB��a�M�ە�*g��^h��,ù?��a�־y�b�H3��iNp�č<�ɗ�MZ{��JE!��zf&`�Z��jRt�S��!�՞yT�J��M0Q*U��9�� |�׆��ZS�=�|."~5y�$�޽�@�\��N[N�F2�e�pcKP��_�k�ػ�$^�xy�}��lc�ߋ�(��?�ԣX�¸�e�T�Q��XCl�&�Ԯ��) ��~`� Slt��\naP��ٙIT䐒Q��&R�$43�Z��ae�k�Kz��{�Δ��[7�ݔtX{�"2�+!i1A�q�1.��h��s�؆�9�73Zim��^_>��[�E��q!y��o�{�(i�?��i�;7�Di��ML��EF��/��(o�ދ�^��_25��4�#@��|x��y�h$��x��>�a2쫖��Q��g�&��s2��!,3�v� 30ϭ�i��5�P��"66:T448,Found URL "http://193.233.255.73/--i66jzc1v3k2rcq6qozl4content-disposition:" - Source: "00000000-00001036.00000000.67492.00080000.00000004.mdmp") Found URL "http://193.233.255.73/loghub/masternwlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemhttp://193.233.255.73/loghub/masteracmgallusersprofile=c:\programdatalogonserver=\\hapubws-pcprocessor_architecture=x86programdata=c:\programdataprogramfiles=c:\program" - Source: "00000000-00001036.00000000.67492.00080000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpdntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00003000.00000001.69232.00360000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemlmemhttp://77.91.124.1/theme/index.phpjklmemmicrosoft" - Source: "00000000-00003000.00000002.71152.00360000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemlmem/themelmemhttp://77.91.124.1/theme/index.phpmicrosoft" - Source: "00000000-00003000.00000003.79819.00360000.00000004.mdmp")67:Tb63,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.epicgames.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /account-portal/static/epic-favicon-96x96.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 26 Oct 2023 16:22:35 GMTExpires: Fri, 25 Oct 2024 16:22:35 GMTAge: 325355Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /en_US/i/icon/pp_favicon_x.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "POST /loghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001036.00000000.67492.00080000.00000004.mdmp") Found string "ST /loghub/master HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001036.00000001.67915.00080000.00000004.mdmp")68:T1be4,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLw" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDk" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13x" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBde13xIZENXEmRaEb4JXwU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "IWZzHshBOCggCEwdzEkpLy9ROx7U76vGU" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmb" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDiqPgG5QpuyCQrl9PBuZos%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGAy%2Fdiu84vFCW7%2FIayIdNI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiT" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDXjiTYwV9zDBJXr%2BzP1lEY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQE" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQE" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCXtQEEuMx0gAkkEcVQ5Vat HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"69:T4a1,"6c752b163faa36a307dfe59849216aff.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002988) "6c752b163faa36a307dfe59849216aff.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002988) "6c752b163faa36a307dfe59849216aff.exe" called "FindNextFileW" with parameter 7ol4Gg17.exe (UID: 00000000-00002988) "6c752b163faa36a307dfe59849216aff.exe" called "FindNextFileW" with parameter vY0YT87.exe (UID: 00000000-00002988) "vY0YT87.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00001892) "vY0YT87.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001892) "vY0YT87.exe" called "FindNextFileW" with parameter 6Yj0YY4.exe (UID: 00000000-00001892) "vY0YT87.exe" called "FindNextFileW" with parameter VH2Zk03.exe (UID: 00000000-00001892) "VH2Zk03.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00002456) "VH2Zk03.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002456) "VH2Zk03.exe" called "FindNextFileW" with parameter 3PA29Ih.exe (UID: 00000000-00002456) "VH2Zk03.exe" called "FindNextFileW" with parameter 5hi3ts2.exe (UID: 00000000-00002456)6a:T1403,Dropped file: "clip.dll" - Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00001512] Dropped file: "cred.dll" - Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00003000] Dropped file: "2DE68166199B7ACB09381A14A0B3E7C1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\2DE68166199B7ACB09381A14A0B3E7C1]- [targetUID: 00000000-00003524] Dropped file: "MALD2CT0.js" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\MALD2CT0.js]- [targetUID: 00000000-00002536] Dropped file: "Z1V6K8BG.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\Z1V6K8BG.htm]- [targetUID: 00000000-00000176] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002536] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002104] Dropped file: "739F2FF4259CDC6CBE7B90F1A95601EF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF]- [targetUID: 00000000-00000872] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000176] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002536] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002824] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002536] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00000176] Dropped file: "SMIYBUKG.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\SMIYBUKG.txt]- [targetUID: 00000000-00002536] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_A6BAE97222CD7ED33A1A3AA1A54175C7" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_A6BAE97222CD7ED33A1A3AA1A54175C7]- [targetUID: 00000000-00002672] Dropped file: "E87CE99F124623F95572A696C80EFCAF_70445D979E6BDC085A06FAD3F5B6E186" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_70445D979E6BDC085A06FAD3F5B6E186]- [targetUID: 00000000-00003880] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_524BBAFA66E109E6A3AAE054ADFDA005" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_524BBAFA66E109E6A3AAE054ADFDA005]- [targetUID: 00000000-00002536] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00003524] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00000176] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00000176] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00000176] Dropped file: "265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC]- [targetUID: 00000000-00002536] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002536] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_7D64FE6D7F78442DEDB8122142800D87" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_7D64FE6D7F78442DEDB8122142800D87]- [targetUID: 00000000-00000872] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00000872]6b:T8ac,"dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "glyph_alert_critical_big-2x_1_.png" has type "PNG image data 224 x 200 8-bit/color RGBA non-interlaced" and extension "png" "epic-favicon-96x96_1_.png" has type "PNG image data 96 x 96 8-bit/color RGBA non-interlaced" and extension "png" "sprite_form_2x_1_.png" has type "PNG image data 48 x 1350 8-bit colormap non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "icon-PN-check_1_.png" has type "PNG image data 121 x 133 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png"6c:T4001,"initAft()