24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 85:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 87545d25bd7b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 87545d25bd7b…. Malware family: Crifi.Generic. Threat score 100/100. 6/25 AV engines flagged this file. 23 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/87545d25bd7ba1490287b40c178d3b75765457565caa7d27a801d8a2e21d5fd3","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","87545d25bd7ba1490287b40c178d3b75765457565caa7d27a801d8a2e21d5fd3"],"about":{"@type":"SoftwareApplication","name":"2f3c9be60064deb5a63a27f1c4e50cc0.exe","applicationCategory":["peexe","executable"],"identifier":"87545d25bd7ba1490287b40c178d3b75765457565caa7d27a801d8a2e21d5fd3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":23,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T45a,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindResourceA" with parameter "7993428" - (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindResourceA" with parameter "332488" - (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindResourceA" with parameter "332496" - (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindResourceA" with parameter "332524" - (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindResourceA" with parameter "332536" - (UID: 00000000-00003932) "Xj6Hl21.exe" called "FindResourceA" with parameter "1178556" - (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindResourceA" with parameter "17044168" - (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindResourceA" with parameter "17044176" - (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindResourceA" with parameter "17044204" - (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindResourceA" with parameter "17044216" - (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindResourceA" with parameter "17044232" - (UID: 00000000-00003284)26:Ta43,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '378960'}" (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '378992'}" (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '378976'}" (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '378944'}" (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadResource with parameter {'hModule': '53215233', 'hResInfo': '53341984'}" (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadResource with parameter {'hModule': '53215233', 'hResInfo': '53317136'}" (UID: 00000000-00003932) "Xj6Hl21.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17090640'}" (UID: 00000000-00003284) "Xj6Hl21.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17090672'}" (UID: 00000000-00003284) "Xj6Hl21.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17090656'}" (UID: 00000000-00003284) "Xj6Hl21.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17090624'}" (UID: 00000000-00003284) "Xj6Hl21.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17090576'}" (UID: 00000000-00003284) "SP4Rr42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532432'}" (UID: 00000000-00002420) "SP4Rr42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532464'}" (UID: 00000000-00002420) "SP4Rr42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532448'}" (UID: 00000000-00002420) "SP4Rr42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532416'}" (UID: 00000000-00002420) "SP4Rr42.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532368'}" (UID: 00000000-00002420) "Qf8gp08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9160784'}" (UID: 00000000-00002404) "Qf8gp08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9160816'}" (UID: 00000000-00002404) "Qf8gp08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9160800'}" (UID: 00000000-00002404) "Qf8gp08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9160768'}" (UID: 00000000-00002404) "Qf8gp08.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '9160720'}" (UID: 00000000-00002404)27:T64e,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00003436.00000000.70327.01352000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00003436.00000000.70327.01352000.00000020.mdmp") Found reference to API "[InjectDependency] WriteProcessMemory failed6" (Indicator: "WriteProcessMemory"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp")28:T584,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "5kB6gI2.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteIntPtr" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt32" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "5kB6gI2.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt64" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHINSTANCE" in "5kB6gI2.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "5kB6gI2.exe"29:T53a,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API "LoadLibraryA(" (Indicator: "LoadLibrary"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp")2a:T16cc,Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") file/memory contains long string with (Indicator: "Oid"; File: "SSL") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "AesManaged" (Indicator: "Aes"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "AesManaged" (Indicator: "AesManaged"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to "RC2MOoJ6edqBSHEvckV" (Indicator: "RC2"; File: "00000000-00003436.00000000.70327.01352000.00000020.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp")2b:T6f2,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "2c8708" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a8882b00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2c8708" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "288c2b00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2c8708" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "288e2b00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2c8708" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a88d2b00"}2c:T1806,Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"2d:T96a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to perform AES encryption (Dotnet String) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: YARA signature match - AES Encryption2e:T27a7,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000001a000000c0ce810000007d00b0cf8100000005000000000000000000000000000400000058f179001a0000001a00000017685677c8ce810000000000435c56776be728770000000054027d0000007d0050017d00000005000000000050017d00acf0790074017d00d8f07900040000000000050050017d001e000000a0ed8100f8f079001e00000030f179001a00000030f17900531a577700000500471b57770000000002000002a8567f00200000209c976200b2f4567700000000800000000000930036270011 (UID: 00000000-00003932) "Xj6Hl21.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003284) "SP4Rr42.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002420) "Qf8gp08.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002404) "Vr8oH09.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002408) "1dP82wv5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002416) "1dP82wv5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002416) "1dP82wv5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400004e6bf0e1dc0266ffcc0499ffff04ccffff04e0e1dc0200004e6b0000000001000000 (UID: 00000000-00002416) "1dP82wv5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e86027d1688e8dc022a9d2277000000002483377704000000000000000000000004fadc0200000000e79c2277020007809ce2dc020000000076000000ece2dc02feffffff74e2dc02cf005777d60057779dcb8d75760000003b000000ece2dc026f006e0048e2dc026e007400b0e2dc02 (UID: 00000000-00002416) "1dP82wv5.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002416) "1dP82wv5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400004e6b60e3330466ffcc0499ffff04ccffff0450e3330400004e6b0000000001000000 (UID: 00000000-00002416) "1dP82wv5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff0400004e6b10dfdf0266ffcc0499ffff04ccffff0400dfdf0200004e6b0000000001000000 (UID: 00000000-00002416) "2pX3090.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b567767c3df77000000009401930000009300000093000000000018004e001900000012000000000000000000000000000000 (UID: 00000000-00000720) "2pX3090.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005c0038015c00000000005cfb8e0014c609690000930007000000d0cd97000000930038ce9700a05698000000000078fb8e00000000000600000064fc8e00070000000700000017685677d8cd970000000000435c567777c3df7700000000bc019300000093005001930084fc8e00145c56775001930097c3df7774019300000000000600000000015c00500193000d000000a0569800f22c57770d00000000fe00fe070000000000000050015c0000100000c8056300000000000200000240d09700280000280b290700feffffff0000000080000000000000002923000a08229800 (UID: 00000000-00000720) "2pX3090.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000720)2f:T1ef1,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000c500000000000000c8ce810026cf810066000000c8ce8100420000000300000000000000d0000000ff010000f8f17900c0d16b77c8ce8100c50000004cf279000000000030f279001cf2790056170500c8ce8100c50000004cf2790030f27900c8ce8100309a8300c6000000d3d88175 (UID: 00000000-00003932) "1dP82wv5.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002416) "2pX3090.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100001ea32e0073902e0020fd8e00a0902e00d4fc8e00c4482f0012000000acc22e000000000010000000c4482f0012000000acc22e00a09c2e0006000000029e2e00060000005a9e2e0001be2e0046dd2e0020fd8e00219e2e002cfd8e007804c800c4482f00120000000600000045e32e00 (UID: 00000000-00000720) "2pX3090.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100005e3c17009f22170020fd8e00cc221700d4fc8e00608b2900ac0000002c8f170018fc8e0010000000608b2900ac0000002c8f1700843317000e000000423717000e0000009a371700018a170042e8170020fd8e00613717002cfd8e005c04f401608b2900ac0000000e00000089ee1700 (UID: 00000000-00000720) "2pX3090.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000f4010040010018f62b0054f7000054f70000ed1f17000040f401000001000cf62b00b820170034fb8e00f0503f0054f700000000170034fb8e00cb2217007ef32e00eff32e0000001700f0503f006c27f4019cfd8e004cfb8e00000017000100000000000000a4c41c0046020000 (UID: 00000000-00000720) "2pX3090.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000001000000010000000000000000000000640065006c002d0000000000000000000000000000000000010000002f00000000000000000000006c006c0000002e00330030003300310039005c000000000000002e000000000000000000000000000000000000000000 (UID: 00000000-00000720) "2pX3090.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb06765852a00000f0fd7f9a5c577700e0fd7f00bf8e0044f0fd7f00000000400000003f0000002e00000000f0fd7ff4be8e00c15c577760825e772e00000000f0fd7f9a5c577700e0fd7f18bf8e005789567780835e7713175b75d8eb0676 (UID: 00000000-00000720) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0676b8122e000090fd7f9a5c577700f0fd7fb8be20004490fd7f00000000400000003f0000001e0000000090fd7facbe2000c15c577760825e771e0000000090fd7f9a5c577700f0fd7fd0be20005789567780835e7713175b75d8eb0676 (UID: 00000000-00002716) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00002716) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636df55f0000ae01000000006c6df55f8b79eef5d8d755605cee200058ee200000000000000000000000000000000000d8d75560b0ed20000000000020ee20005cee2000f0ed2000ff23f55fc83bfe5f30ee20003117f55f080000001c5c557714a15677ffffffff2400000018ee2000 (UID: 00000000-00002716) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002716) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000d8a3260010000000508c26000100000003000000010000000c0000000000000000000000000000000100000001000000000000000000005c484150554257530000000000000000000000000000000000010000002f0000770000000000000000675f666c6167733d330077696e646f77 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310069687245020000000078ef19002827036968724502c4ef1900072302696872450220000000000000005c37026928127d02e08c9c0228127d02e08c9c02020000000000000018000000c4ee170dc8ef19002823706a00002100000000000c000000e08c9c02d4ef19002f99be680c000000 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750e24902d8a325000000000050e24902100000000000000024f0190050dc7a7550e24902100000003c8c4b02f43540051000000050f01900a6ecfb710200000000000000180000000832be6854f019002823706a00002100000000000c0000000832be6860f019002f99be680c000000 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000010000005cf119006a6f756300000000bc6f756321a51f3cd8ec19000000000020f3190015debd756990b949feffffff7f67c575e2d84e7728244b6e02000000000000001800000030a5be681cf119002823706a00002100000000000c00000030a5be6828f119002f99be680c000000 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47037458fe4b028c4703740000000058fe4b022ce61900086d567718815e7700000000e0e6190000000000de5475636ce6190095e15277f6e21800feffffff6b2c577731195b7502100000000000000000010040e61900c89f56778c4703740000000000000000 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338a0369e8094c020000000078ef190028270369e8094c02c0ef190007230269e8094c0220000000000000005c37026928127d02fc46a70228127d0202000000000000001800000000094c02c4ef19002823706a00002100000000000c000000fc46a702d0ef19002f99be680c000000 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750e24902d8a325000000000050e2490210000000000000002cf0190050dc7a7550e2490210000000e44a4b02e43640051000000058f01900a6ecfb710200000000000000180000000832be685cf019002823706a00002100000000000c0000000832be6868f019002f99be680c000000 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000058f119006a6f756300000000bc6f75632da51f3cd4ec19000000000020f3190015debd756990b949feffffff7f67c575e2d84e7728244b6e02000000000000001800000030a5be6818f119002823706a00002100000000000c00000030a5be6824f119002f99be680c000000 (UID: 00000000-00001300) "4Wo403IN.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000338a036978622d000000000080ee19002827036978622d00c8ee19000723026978622d0020000000000000005c37026928127d024c1d9b0228127d0202000000000000001800000000622d00ccee19002823706a00002100000000000c0000004c1d9b02d8ee19002f99be680c000000 (UID: 00000000-00001300)30:T60a,Found string "SELECT * FROM Wi" (Indicator: "select * from "; Source: "00000000-00001300-00000C94-94765743") Found string "SELECT * FROM Win32_VideoControl" (Indicator: "select * from "; Source: "00000000-00001300-00000C94-94787953") Found string "SELECT * FROM Win32_Process Wher" (Indicator: "select * from "; Source: "00000000-00001300-00000C94-94825037") Found string "SELECT * FROM Win32_OperatingSys" (Indicator: "select * from "; Source: "00000000-00001300-00000C94-94918309") Found string "SELECT * FROM Win32_LogicalDisk WHERE DeviceID = '" (Indicator: "select * from "; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "SELECT * FROM Win32_PhysicalMemory" (Indicator: "select * from "; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp")31:T7d8,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Xj6Hl21.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Xj6Hl21.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "SP4Rr42.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SP4Rr42.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Qf8gp08.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Qf8gp08.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Vr8oH09.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Vr8oH09.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1dP82wv5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1dP82wv5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2pX3090.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2pX3090.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")32:T639,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp")33:T930,"4Wo403IN.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4Wo403IN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "RegAsm.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "RegAsm.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "RegAsm.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "RegAsm.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "RegAsm.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "")34:Tb90,"2pX3090.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2pX3090.exe" at 00000000-00000720-0000010C-2689953 "2pX3090.exe" queries volume information of "C:\" at 00000000-00000720-0000010C-25318864 "2pX3090.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\FANBooster131\FANBooster131.exe" at 00000000-00000720-0000010C-25792265 "4Wo403IN.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00001300-0000010C-2959078 "4Wo403IN.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00001300-0000010C-2970613 "4Wo403IN.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00001300-0000010C-3872296 "4Wo403IN.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00001300-0000010C-3879687 "4Wo403IN.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001300-0000010C-4977204 "qemu-ga.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe" at 00000000-00001704-0000010C-1371823 "5kB6gI2.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5kB6gI2.exe" at 00000000-00003436-0000010C-1429141 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" at 00000000-00003360-0000010C-2815670 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003360-0000010C-8562249 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003360-0000010C-8566164 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003360-0000010C-10474289 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003360-0000010C-10477758 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003360-0000010C-1154348835:T845,"2pX3090.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00000720) "2pX3090.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00000720) "2pX3090.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00000720) "2pX3090.exe" called "CreateDirectoryW" with parameter %TEMP%\FANBooster131 (UID: 00000000-00000720) "2pX3090.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00000720) "2pX3090.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00000720) "2pX3090.exe" called "CreateDirectoryW" with parameter %TEMP%\tempCMS4CE6aJWI15Cd (UID: 00000000-00000720) "2pX3090.exe" called "CreateDirectoryW" with parameter %TEMP%\tempAVS4CE6aJWI15Cd (UID: 00000000-00000720) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002716) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002716) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002716) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002716) "4Wo403IN.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001300) "4Wo403IN.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001300) "4Wo403IN.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Wind (UID: 00000000-00001300) "4Wo403IN.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001300) "RegAsm.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003360) "RegAsm.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003360) "RegAsm.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00003360)36:T5f0,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\Xj6Hl21.exe" - (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\6kG0qp7.exe" - (UID: 00000000-00003932) "Xj6Hl21.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\SP4Rr42.exe" - (UID: 00000000-00003284) "Xj6Hl21.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5kB6gI2.exe" - (UID: 00000000-00003284) "SP4Rr42.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\Qf8gp08.exe" - (UID: 00000000-00002420) "SP4Rr42.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4Wo403IN.exe" - (UID: 00000000-00002420) "Qf8gp08.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\Vr8oH09.exe" - (UID: 00000000-00002404) "Qf8gp08.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3hL78Uj.exe" - (UID: 00000000-00002404) "Vr8oH09.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\1dP82wv5.exe" - (UID: 00000000-00002408) "Vr8oH09.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\2pX3090.exe" - (UID: 00000000-00002408) "2pX3090.exe" called "CreateProcessW" with parameter ""powershell" Get-MpPreference -verbose" - (UID: 00000000-00000720) "2pX3090.exe" called "CreateProcessW" with parameter ""cmd.exe" /c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTracker" - (UID: 00000000-00000720)37:Tac9c,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003932) "Xj6Hl21.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003284) "SP4Rr42.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002420) "SP4Rr42.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002420) "SP4Rr42.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002420) "SP4Rr42.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002420) "SP4Rr42.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002420) "Qf8gp08.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002404) "Vr8oH09.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002408) "Vr8oH09.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002408) "Vr8oH09.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002408) "Vr8oH09.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002408) "Vr8oH09.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002408) "1dP82wv5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00002416) "1dP82wv5.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00002416) "2pX3090.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %TEMP%\IXP004.TMP\2pX3090.ENU (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %TEMP%\IXP004.TMP\2pX3090.EN (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %TEMP%\IXP004.TMP\sqlite3 (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter sqlite3 (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000720) "2pX3090.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002716) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002716) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002348) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002348) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002348) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002348) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000820) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000820) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000820) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000820) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000820) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000820) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000820) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002160) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002160) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002160) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002160) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000728) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000728) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000728) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000728) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000728) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000728) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000728) "4Wo403IN.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001300) "4Wo403IN.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001300) "qemu-ga.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001704) "qemu-ga.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001704) "5kB6gI2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003436) "5kB6gI2.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003436) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\firefox.exe (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\iexplore.exe (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00003360) "RegAsm.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00003360)38:T1b5c,"SELECT * FROM Wi" (Source: 00000000-00001300-00000C94-94765743, Indicator: "select * from wi") "SELECT * FROM Win32_VideoControl" (Source: 00000000-00001300-00000C94-94787953, Indicator: "select * from win32_videocontrol") "SELECT * FROM Win32_Process Wher" (Source: 00000000-00001300-00000C94-94825037, Indicator: "select * from win32_process wher") "SELECT * FROM" (Source: 00000000-00001300-00000C94-94870580, Indicator: "select * from") "SELECT * FROM Win32_OperatingSys" (Source: 00000000-00001300-00000C94-94918309, Indicator: "select * from win32_operatingsys") "SELECT * FROM Win32_LogicalDisk WHERE DeviceID = '" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select * from win32_logicaldisk where deviceid = '") "SELECT * FROM Win32_Processor" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select * from win32_processor") "SELECT * FROM Win32_PhysicalMemory" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select * from win32_physicalmemory") "SELECT * FROM Win32_VideoController" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select * from win32_videocontroller") "SELECT action_url, origin_url, username_value, password_value FROM logins" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select action_url, origin_url, username_value, password_value from logins") "SELECT name, value FROM autofill" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select name, value from autofill") "SELECT tab_url, target_path FROM downloads" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select tab_url, target_path from downloads") "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, origin, billing_address_id, nickname FROM credit_cards" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select name_on_card, expiration_month, expiration_year, card_number_encrypted, origin, billing_address_id, nickname from credit_cards") "SELECT name_on_card, exp_month, exp_year, last_four, nickname, bank_name, card_art_url, network FROM masked_credit_cards" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select name_on_card, exp_month, exp_year, last_four, nickname, bank_name, card_art_url, network from masked_credit_cards") "SELECT host_key, is_httponly, path, is_secure, expires_utc, name, value, encrypted_value FROM cookies" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select host_key, is_httponly, path, is_secure, expires_utc, name, value, encrypted_value from cookies") "SELECT service, encrypted_token FROM token_service" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select service, encrypted_token from token_service") "SELECT url, last_visit_time FROM(SELECT url, last_visit_time, id FROM urls ORDER BY id DESC LIMIT 2500) ORDER BY id ASC" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select url, last_visit_time from(select url, last_visit_time, id from urls order by id desc limit 2500) order by id asc"), "SELECT * FROM" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select * from"), "CREATE TABLE" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, Indicator: "create table"), "SELECT name FROM sqlite_master WHERE type='table';" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select name from sqlite_master where type='table';"), "SELECT encryptedUsername encryptedPassword formSubmitURL FROM moz_logins" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select encryptedusername encryptedpassword formsubmiturl from moz_logins"), "SELECT fieldname value FROM moz_formhistory;" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select fieldname value from moz_formhistory;"), "SELECT place_id content FROM moz_annos WHERE anno_attribute_id = 1" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select place_id content from moz_annos where anno_attribute_id = 1"), "SELECT url FROM moz_places WHERE id = {0}" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select url from moz_places where id = {0}"), "SELECT host isHttpOnly path isSecure expiry name value FROM moz_cookies" (Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, Indicator: "select host ishttponly path issecure expiry name value from moz_cookies")39:T94d,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00002404.00000964.626575.00050000.wprm") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000000.66456.00BA0000.00000004.mdmp, 00000000-00000720.00000000.66456.00FC0000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00BA0000.00000004.mdmp, 00000000-00000720.00000001.68377.00FC0000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00BA0000.00000004.mdmp, 00000000-00000720.00000002.68664.00FC0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp") Found reference to API "9211208975,656,3137,,CreateProcessW,kernel32.dll,"252:03:11.649",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000720.00000000.66456.00FC0000.00000004.mdmp, 00000000-00000720.00000001.68377.00FC0000.00000004.mdmp, 00000000-00000720.00000002.68664.00FC0000.00000004.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "ElevateCreateProcess WRP?" (Indicator: "CreateProcess"; Source: "00000000-00000720.00000001.68377.00930000.00000004.mdmp")3a:T4d5,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp")3b:Tb204,Found reference to API (Indicator: "CheckTokenMembership"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "DecryptFileA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FreeSid"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "EqualSid"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "RegCloseKey"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FindNextFileA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FindClose"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LocalAlloc"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "lstrcmpA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CompareStringA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetLastError"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "DeleteFileA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GlobalFree"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CloseHandle"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetProcAddress"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GlobalLock"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LocalFree"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FreeLibrary"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "ReadFile"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SizeofResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "WriteFile"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetFileTime"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetFilePointer"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FindResourceA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CreateMutexA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FreeResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetVersion"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetTempPathA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CreateFileA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetEvent"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "TerminateThread"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetVersionExA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LockResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CreateThread"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "ResetEvent"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LoadResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "ExitProcess"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CreateProcessA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FormatMessageA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CreateEventA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CharUpperA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "MessageBeep"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CharPrevA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "LoadStringA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CharNextA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "EnableWindow"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "ReleaseDC"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "PeekMessageA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SendMessageA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "MessageBoxA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "ShowWindow"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetWindowPos"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetDC"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetWindowRect"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "Sleep"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "TerminateProcess"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetTickCount"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "MulDiv"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00002416.00000000.66100.00F11000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00002416.00000000.66100.00F11000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; File: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "SysFreeString"; File: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "CreateFontA"; File: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; File: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "CreateProcess"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "LoadLibrary"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "NtQueryObject"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "QueryDosDevice"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFile"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMapping"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileName"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; File: "00000000-00003436.00000000.70327.01352000.00000020.mdmp") Found reference to API (Indicator: "VirtualAlloc"; File: "00000000-00003436.00000000.70327.01352000.00000020.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; File: "00000000-00003436.00000000.70327.01352000.00000020.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00000720.00000000.66456.01F80000.00000040.mdmp, 00000000-00000720.00000001.68377.01F80000.00000040.mdmp, 00000000-00000720.00000002.68664.01F80000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000720.00000000.66456.01F80000.00000040.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API (Indicator: "VaultFree"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API (Indicator: "VaultOpenVault"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API (Indicator: "VaultCloseVault"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API (Indicator: "VaultGetItem"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentHwProfileA"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CredEnumerateA"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "PathAppend"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "FindResource"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CredFree"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "PathCombine"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "PathIsRelative"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "RtlUnicodeStringToAnsiString"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetail"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.059D0000.00000002.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "NtDuplicateObject"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000720.00000001.68377.01F80000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000720.00000002.68664.01F80000.00000040.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CryptDeriveKey"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CryptDuplicateKey"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp")3c:T454,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "FindResource" (Indicator: "FindResource"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp")3d:T83c,"6kG0qp7.exe" contains export function called "_cgo_dummy_export" at ordinal 1 "sqlite3.dll" contains export function called "sqlite3_activate_cerod" at ordinal 1 "sqlite3.dll" contains export function called "sqlite3_activate_see" at ordinal 2 "sqlite3.dll" contains export function called "sqlite3_aggregate_context" at ordinal 3 "sqlite3.dll" contains export function called "sqlite3_auto_extension" at ordinal 4 "sqlite3.dll" contains export function called "sqlite3_backup_finish" at ordinal 5 "sqlite3.dll" contains export function called "sqlite3_backup_init" at ordinal 6 "sqlite3.dll" contains export function called "sqlite3_backup_pagecount" at ordinal 7 "sqlite3.dll" contains export function called "sqlite3_backup_remaining" at ordinal 8 "sqlite3.dll" contains export function called "sqlite3_backup_step" at ordinal 9 "sqlite3.dll" contains export function called "sqlite3_bind_blob" at ordinal 10 "sqlite3.dll" contains export function called "sqlite3_bind_blob64" at ordinal 11 "sqlite3.dll" contains export function called "sqlite3_bind_double" at ordinal 12 "sqlite3.dll" contains export function called "sqlite3_bind_int" at ordinal 13 "sqlite3.dll" contains export function called "sqlite3_bind_int64" at ordinal 14 "sqlite3.dll" contains export function called "sqlite3_bind_null" at ordinal 15 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_count" at ordinal 16 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_index" at ordinal 17 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_name" at ordinal 18 "sqlite3.dll" contains export function called "sqlite3_bind_pointer" at ordinal 19 "sqlite3.dll" contains export function called "sqlite3_bind_text" at ordinal 20 "sqlite3.dll" contains export function called "sqlite3_bind_text64" at ordinal 21 "sqlite3.dll" contains export function called "sqlite3_bind_value" at ordinal 22 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob" at ordinal 23 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob64" at ordinal 243e:T837,"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup\*.*") in Source: 00000000-00001300-00000C28-30358173244 ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000720.00000001.68377.00930000.00000004.mdmp 00000000-00000720.00000002.68664.00930000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000720.00000001.68377.00930000.00000004.mdmp 00000000-00000720.00000002.68664.00930000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00000720.00000001.68377.00930000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.00930000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00000720.00000001.68377.00930000.00000004.mdmp 00000000-00000720.00000002.68664.00930000.00000004.mdmp "sers\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "sers\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00000720.00000001.68377.00930000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp3f:T364c,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe "System\CurrentControlSet\Control\Session Manager" in Source: 37736-17-0040256D "SOFTWARE\WOW6432Node\Clients\Sta" in Source: 00000000-00001300-00000C94-94798529 "SOFTWARE\Clients\StartMenuIntern" in Source: 00000000-00001300-00000C94-94803793 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninst" in Source: 00000000-00001300-00000C94-94891528 "SOFTWARE\Microsoft\Windows NT\Cu" in Source: 00000000-00001300-00000C94-94928929 "Software\Valve\S" in Source: 00000000-00001300-00000C94-95093618 "%APPDATA%\Opera Software\Opera GX Stable\*" in Source: 00000000-00001300-00000C28-18186819356 "%APPDATA%\Opera Software\Opera Stable\*" in Source: 00000000-00001300-00000C28-18203914152 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00001300-00000C28-18298482872 "%LOCALAPPDATA%\AVAST Software\Browser\User Data\*" in Source: 00000000-00001300-00000C28-18349950146 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\*" in Source: 00000000-00001300-00000C28-18376726990 "%APPDATA%\Opera Software\*" in Source: 00000000-00003360-00000C28-35430766128 "Software\Enigma Protector\BB3DF1FDBB935E9B-50AFA6E27F8A32AF" in Source: 00000000-00000720.00000000.66456.00930000.00000004.mdmp 00000000-00000720.00000001.68377.00930000.00000004.mdmp 00000000-00000720.00000002.68664.00930000.00000004.mdmp "Software\Enigma Protector\%.8x%.8x-%.8x%.8x" in Source: 00000000-00000720.00000000.66456.00930000.00000004.mdmp 00000000-00000720.00000000.66456.01F80000.00000040.mdmp 00000000-00000720.00000001.68377.00930000.00000004.mdmp 00000000-00000720.00000001.68377.01F80000.00000040.mdmp 00000000-00000720.00000002.68664.00930000.00000004.mdmp 00000000-00000720.00000002.68664.01F80000.00000040.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00000720.00000000.66456.00930000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000720.00000000.66456.00B90000.00000004.mdmp 00000000-00000720.00000001.68377.00B90000.00000004.mdmp 00000000-00000720.00000002.68664.00B90000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000720.00000000.66456.00B90000.00000004.mdmp 00000000-00000720.00000001.68377.00B90000.00000004.mdmp 00000000-00000720.00000002.68664.00B90000.00000004.mdmp "Software\Enigma Protector\BB3DF1FDBB935E9B-50AFA6E27F8A32AF\1D23E801FF916F1C-DF69CE3484AE41BB" in Source: 00000000-00000720.00000000.66456.01F80000.00000040.mdmp 00000000-00000720.00000001.68377.01F80000.00000040.mdmp 00000000-00000720.00000002.68664.01F80000.00000040.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features' is denied.andling" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features' is denied." in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\vmhgfs+" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Classes\Foxmail\shell\open\command" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676z" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676X" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000720.00000000.66456.03510000.00000004.mdmp 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00000720.00000001.68377.03510000.00000004.mdmp 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00000720.00000002.68664.03510000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000720.00000002.68664.03510000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000720.00000002.68664.03510000.00000004.mdmp40:T4cb,"\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" "\Sessions\1\BaseNamedObjects\IsoScope_118_IESQMMUTEX_0_519" "Local\!BrowserEmulation!SharedMemory!Mutex" "Local\URLBLOCK_DOWNLOAD_MUTEX" "Local\ZonesCacheCounterMutex" "IsoScope_118_IESQMMUTEX_0_303" "IsoScope_118_IESQMMUTEX_0_331" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_118_IESQMMUTEX_0_519" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_280" "UpdatingNewTabPageData" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "IsoScope_118_IE_EarlyTabStart_0x230_Mutex" "Local\ZonesLockedCacheCounterMutex" "Local\VERMGMTBlockListFileMutex" "IsoScope_118_ConnHashTable<280>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_280" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_118_IE_EarlyTabStart_0x230_Mutex"41:T2faf,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2f3c9be60064deb5a63a27f1c4e50cc0.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "SP4Rr42.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "SP4Rr42.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Vr8oH09.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Vr8oH09.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1dP82wv5.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1dP82wv5.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1dP82wv5.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1dP82wv5.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%TEMP%\IXP004.TMP\sqlite3" - [base:0; Status:c0000135] "2pX3090.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "4Wo403IN.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "qemu-ga.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "qemu-ga.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "qemu-ga.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "qemu-ga.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "qemu-ga.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "qemu-ga.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "qemu-ga.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "qemu-ga.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "5kB6gI2.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135]42:T515,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "6kG0qp7.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "Qf8gp08.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Vr8oH09.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5kB6gI2.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "qemu-ga.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT43:T9e2,Found string "https://facebook.com/login" (Indicator: "facebook.com"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "FHNHI61G.txt") file/memory contains long string with (Indicator: "youtube"; File: "N0A62UDY.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "Q40N8Z50.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "8B44W1LU.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "JJIG3WB7.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921789960934431083036368890802631080211VISITOR_INFO1_LIVEgl0_jycmAbMyoutube.com/9217305669401631116429369800002831080211" (Indicator: "youtube"; File: "YYOI124G.txt") Found string "0BXZjrBt2Y5tUnm1u..BllsM7.Up.AAA.0.0.BllsM7.AWX0hco-5Y8facebook.com/9217340958809631098324340861597031080211O8OWZcxQ3qw61JD1ovoIxVFqfacebook.com/921765907494431160686340892797031080211" (Indicator: "facebook.com"; File: "8KAAB57S.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921789960934431083036368890802631080211" (Indicator: "youtube"; File: "BEGEX59H.txt") Found string "0BXZjrBt2Y5tUnm1u..BllsM7.Up.AAA.0.0.BllsM7.AWX0hco-5Y8facebook.com/9217340958809631098324340861597031080211" (Indicator: "facebook.com"; File: "W6KEC8RI.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "LXBAKUOW.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL")44:Tec9,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 04 Jan 2024 13:42:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3438 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 04 Jan 2024 13:40:54 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3541 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 04 Jan 2024 14:20:49 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1147 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 04 Jan 2024 13:40:54 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3542 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 04 Jan 2024 13:52:49 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2828 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 04 Jan 2024 13:48:07 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3123 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......45:Ta45f,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "KERNEL32" at base 75a80000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6ac40000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "ADVAPI32.DLL" at base 75930000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74060000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "DWMAPI.DLL" at base 73d80000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "COMCTL32.DLL" at base 74310000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "UXTHEME.DLL" at base 74060000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 773b0000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "CRYPTBASE.DLL" at base 75310000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75f60000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "CLBCATQ.DLL" at base 759e0000 "2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "OLEAUT32.DLL" at base 75760000 "Xj6Hl21.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a360000 "Xj6Hl21.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "SP4Rr42.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "SP4Rr42.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "SP4Rr42.exe" loaded module "KERNEL32" at base 75a80000 "SP4Rr42.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "SP4Rr42.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68ff0000 "SP4Rr42.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "Qf8gp08.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a360000 "Qf8gp08.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "Vr8oH09.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "Vr8oH09.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Vr8oH09.exe" loaded module "KERNEL32" at base 75a80000 "Vr8oH09.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Vr8oH09.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69020000 "Vr8oH09.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68ff0000 "Vr8oH09.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "1dP82wv5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "1dP82wv5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "1dP82wv5.exe" loaded module "KERNEL32" at base 75a80000 "1dP82wv5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "1dP82wv5.exe" loaded module "DWMAPI.DLL" at base 73d80000 "1dP82wv5.exe" loaded module "COMCTL32.DLL" at base 74310000 "1dP82wv5.exe" loaded module "KERNEL32.DLL" at base 75a80000 "1dP82wv5.exe" loaded module "UXTHEME.DLL" at base 74060000 "1dP82wv5.exe" loaded module "IMM32.DLL" at base 75b60000 "1dP82wv5.exe" loaded module "COMCTL32" at base 74310000 "1dP82wv5.exe" loaded module "SHELL32.DLL" at base 76520000 "1dP82wv5.exe" loaded module "OLE32.DLL" at base 773b0000 "1dP82wv5.exe" loaded module "ADVAPI32.DLL" at base 75930000 "1dP82wv5.exe" loaded module "PROPSYS.DLL" at base 74190000 "1dP82wv5.exe" loaded module "OLEAUT32.DLL" at base 75760000 "1dP82wv5.exe" loaded module "APPHELP.DLL" at base 752c0000 "1dP82wv5.exe" loaded module "CLBCATQ.DLL" at base 759e0000 "1dP82wv5.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6b4e0000 "1dP82wv5.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75460000 "1dP82wv5.exe" loaded module "URLMON.DLL" at base 763d0000 "1dP82wv5.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 68b30000 "1dP82wv5.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74190000 "1dP82wv5.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6afc0000 "1dP82wv5.exe" loaded module "IERTUTIL.DLL" at base 77170000 "1dP82wv5.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76520000 "1dP82wv5.exe" loaded module "USER32.DLL" at base 75800000 "1dP82wv5.exe" loaded module "SETUPAPI.DLL" at base 75d80000 "1dP82wv5.exe" loaded module "RPCRT4.DLL" at base 75bc0000 "1dP82wv5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "1dP82wv5.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "1dP82wv5.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "2pX3090.exe" loaded module "COMCTL32.DLL" at base 74310000 "2pX3090.exe" loaded module "SHFOLDER.DLL" at base 6ac30000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74060000 "2pX3090.exe" loaded module "KERNEL32.DLL" at base 75a80000 "2pX3090.exe" loaded module "OLE32.DLL" at base 773b0000 "2pX3090.exe" loaded module "ADVAPI32.DLL" at base 75930000 "2pX3090.exe" loaded module "PROFAPI.DLL" at base 75420000 "2pX3090.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75c70000 "2pX3090.exe" loaded module "SSPICLI.DLL" at base 752a0000 "2pX3090.exe" loaded module "RPCRT4.DLL" at base 75bc0000 "2pX3090.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "2pX3090.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "2pX3090.exe" loaded module "KERNEL32" at base 75a80000 "2pX3090.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c380000 "2pX3090.exe" loaded module "SHLWAPI.DLL" at base 758d0000 "2pX3090.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "2pX3090.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "2pX3090.exe" loaded module "VERSION.DLL" at base 748b0000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 636f0000 "2pX3090.exe" loaded module "USER32.DLL" at base 75800000 "2pX3090.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "2pX3090.exe" loaded module "MSCOREE.DLL" at base 6c410000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "2pX3090.exe" loaded module "PSAPI.DLL" at base 75750000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6c410000 "2pX3090.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 622e0000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "2pX3090.exe" loaded module "CRYPTBASE.DLL" at base 75310000 "2pX3090.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6a530000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 62250000 "2pX3090.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 617f0000 "2pX3090.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60fd0000 "2pX3090.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 60e30000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6a2f0000 "2pX3090.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 60d20000 "2pX3090.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 605a0000 "2pX3090.exe" loaded module "NTDLL.DLL" at base 77510000 "2pX3090.exe" loaded module "SHELL32.DLL" at base 76520000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "2pX3090.exe" loaded module "BCRYPT.DLL" at base 74f30000 "2pX3090.exe" loaded module "CRYPTSP.DLL" at base 74e20000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74bb0000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "2pX3090.exe" loaded module "CLBCATQ.DLL" at base 759e0000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76520000 "2pX3090.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75c70000 "2pX3090.exe" loaded module "RPCRTREMOTE.DLL" at base 753b0000 "2pX3090.exe" loaded module "PROPSYS.DLL" at base 74190000 "2pX3090.exe" loaded module "OLEAUT32.DLL" at base 75760000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74190000 "2pX3090.exe" loaded module "NTMARTA.DLL" at base 74290000 "2pX3090.exe" loaded module "SETUPAPI.DLL" at base 75d80000 "2pX3090.exe" loaded module "APPHELP.DLL" at base 752c0000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 70f30000 "2pX3090.exe" loaded module "LINKINFO.DLL" at base 71230000 "2pX3090.exe" loaded module "NTSHRUI.DLL" at base 6cdc0000 "2pX3090.exe" loaded module "SRVCLI.DLL" at base 75010000 "2pX3090.exe" loaded module "CSCAPI.DLL" at base 6cdb0000 "2pX3090.exe" loaded module "SLC.DLL" at base 737c0000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "2pX3090.exe" loaded module "WS2_32.DLL" at base 75b80000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74de0000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74940000 "2pX3090.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74dd0000 "2pX3090.exe" loaded module "%TEMP%\IXP004.TMP\SQLITE3" at base 0 "2pX3090.exe" loaded module "SQLITE3" at base 604d0000 "2pX3090.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "2pX3090.exe" loaded module "RASAPI32.DLL" at base 6c6f0000 "2pX3090.exe" loaded module "RTUTILS.DLL" at base 721c0000 "2pX3090.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75c70000 "2pX3090.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75c70000 "2pX3090.exe" loaded module "RASMAN.DLL" at base 6c6d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 75a80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76520000 "powershell.exe" loaded module "OLE32.DLL" at base 773b0000 "powershell.exe" loaded module "USERENV.DLL" at base 75470000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75c70000 "powershell.exe" loaded module "COMCTL32.DLL" at base 74310000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75930000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75a80000 "powershell.exe" loaded module "SHELL32.DLL" at base 76520000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75760000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75a80000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 75d80000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75bc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74190000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74290000 "powershell.exe" loaded module "APPHELP.DLL" at base 752c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 70f30000 "powershell.exe" loaded module "PROPSYS.DLL" at base 74190000 "powershell.exe" loaded module "LINKINFO.DLL" at base 71230000 "powershell.exe" loaded module "PROFAPI.DLL" at base 75420000 "powershell.exe" loaded module "USER32.DLL" at base 75800000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 6cdc0000 "powershell.exe" loaded module "SRVCLI.DLL" at base 75010000 "powershell.exe" loaded module "CSCAPI.DLL" at base 6cdb0000 "powershell.exe" loaded module "SLC.DLL" at base 737c0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 758d0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74e20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74bb0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c380000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 748b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 5fff0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6c410000 "powershell.exe" loaded module "NTDLL" at base 77510000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6c410000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 5f450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 5eca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 5ec10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5e0a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 75750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 5de60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 5de10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 68c40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 5dd80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 5dcb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5dc60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 5dac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5d9f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 5d9c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6af60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 5d480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 5d370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 5d250000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 6ac30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 75150000 "powershell.exe" loaded module "SSPICLI.DLL" at base 752a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 5cbf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5c910000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 5c8b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 5c820000 "powershell.exe" loaded module "GDI32.DLL" at base 77660000 "powershell.exe" loaded module "NETUTILS.DLL" at base 73d70000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 75a80000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69020000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 75a80000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74060000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75bc0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75c70000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75930000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 759e0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73a30000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 752a0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73c40000 "4Wo403IN.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "4Wo403IN.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "4Wo403IN.exe" loaded module "KERNEL32" at base 75a80000 "4Wo403IN.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4Wo403IN.exe" loaded module "USER32.DLL" at base 75800000 "4Wo403IN.exe" loaded module "ADVAPI32.DLL" at base 75930000 "4Wo403IN.exe" loaded module "NTDLL.DLL" at base 77510000 "4Wo403IN.exe" loaded module "SHELL32.DLL" at base 76520000 "4Wo403IN.exe" loaded module "SHLWAPI.DLL" at base 758d0000 "4Wo403IN.exe" loaded module "MSCOREE.DLL" at base 6c410000 "4Wo403IN.exe" loaded module "KERNEL32.DLL" at base 75a80000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c380000 "4Wo403IN.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "4Wo403IN.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "4Wo403IN.exe" loaded module "VERSION.DLL" at base 748b0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 63660000 "4Wo403IN.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "4Wo403IN.exe" loaded module "PSAPI.DLL" at base 75750000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6c410000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62250000 "4Wo403IN.exe" loaded module "RPCRT4.DLL" at base 75bc0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "4Wo403IN.exe" loaded module "OLE32.DLL" at base 773b0000 "4Wo403IN.exe" loaded module "CRYPTBASE.DLL" at base 75310000 "4Wo403IN.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6e2b0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 621c0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 68c50000 "4Wo403IN.exe" loaded module "SSPICLI.DLL" at base 752a0000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61760000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60f40000 "4Wo403IN.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75c70000 "4Wo403IN.exe" loaded module "PROFAPI.DLL" at base 75420000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "4Wo403IN.exe" loaded module "BCRYPT.DLL" at base 74f30000 "4Wo403IN.exe" loaded module "ADVAPI32" at base 75930000 "4Wo403IN.exe" loaded module "CRYPTSP.DLL" at base 74e20000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74bb0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 60c60000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6a2f0000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 60950000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5fb80000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 5fa30000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5f970000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5f920000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "4Wo403IN.exe" loaded module "WS2_32.DLL" at base 75b80000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74de0000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74940000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74dd0000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5f7f0000 "4Wo403IN.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75c70000 "4Wo403IN.exe" loaded module "RPCRTREMOTE.DLL" at base 753b0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 68be0000 "4Wo403IN.exe" loaded module "CLBCATQ.DLL" at base 759e0000 "4Wo403IN.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75a80000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6e490000 "4Wo403IN.exe" loaded module "OLEAUT32.DLL" at base 75760000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71ed0000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e4b0000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 71fa0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 5f640000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5e7d0000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74060000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 5e630000 "4Wo403IN.exe" loaded module "GDIPLUS.DLL" at base 73ec0000 "4Wo403IN.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73ec0000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75a80000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 77510000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\GDI32.DLL" at base 77660000 "4Wo403IN.exe" loaded module "GDI32.DLL" at base 77660000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DYNAMIC\B7AD5353AE4F44DF28CE7EBC9A8A752A\SYSTEM.DYNAMIC.NI.DLL" at base 5e5c0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "4Wo403IN.exe" loaded module "SECUR32.DLL" at base 75150000 "4Wo403IN.exe" loaded module "WINDOWSCODECS.DLL" at base 73800000 "4Wo403IN.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5e4e0000 "4Wo403IN.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "4Wo403IN.exe" loaded module "PROPSYS.DLL" at base 74190000 "4Wo403IN.exe" loaded module "COMCTL32.DLL" at base 74310000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74190000 "4Wo403IN.exe" loaded module "NTMARTA.DLL" at base 74290000 "4Wo403IN.exe" loaded module "APPHELP.DLL" at base 752c0000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 70f30000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76520000 "4Wo403IN.exe" loaded module "SETUPAPI.DLL" at base 75d80000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 763d0000 "4Wo403IN.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75450000 "4Wo403IN.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71390000 "4Wo403IN.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "qemu-ga.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "qemu-ga.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "qemu-ga.exe" loaded module "KERNEL32" at base 75a80000 "qemu-ga.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "qemu-ga.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "qemu-ga.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "qemu-ga.exe" loaded module "VERSION.DLL" at base 748b0000 "qemu-ga.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 62eb0000 "qemu-ga.exe" loaded module "USER32.DLL" at base 75800000 "qemu-ga.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "qemu-ga.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "qemu-ga.exe" loaded module "MSCOREE.DLL" at base 6c410000 "qemu-ga.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "qemu-ga.exe" loaded module "PSAPI.DLL" at base 75750000 "qemu-ga.exe" loaded module "RPCRT4.DLL" at base 75bc0000 "qemu-ga.exe" loaded module "KERNEL32.DLL" at base 75a80000 "qemu-ga.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61aa0000 "qemu-ga.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "qemu-ga.exe" loaded module "OLE32.DLL" at base 773b0000 "qemu-ga.exe" loaded module "CRYPTBASE.DLL" at base 75310000 "qemu-ga.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cc90000 "qemu-ga.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 63d80000 "5kB6gI2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "5kB6gI2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "5kB6gI2.exe" loaded module "KERNEL32" at base 75a80000 "5kB6gI2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "5kB6gI2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "5kB6gI2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "5kB6gI2.exe" loaded module "VERSION.DLL" at base 748b0000 "5kB6gI2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 62eb0000 "5kB6gI2.exe" loaded module "USER32.DLL" at base 75800000 "5kB6gI2.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "5kB6gI2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "5kB6gI2.exe" loaded module "MSCOREE.DLL" at base 6c410000 "5kB6gI2.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "5kB6gI2.exe" loaded module "PSAPI.DLL" at base 75750000 "5kB6gI2.exe" loaded module "KERNEL32.DLL" at base 75a80000 "5kB6gI2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61aa0000 "5kB6gI2.exe" loaded module "RPCRT4.DLL" at base 75bc0000 "5kB6gI2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "5kB6gI2.exe" loaded module "OLE32.DLL" at base 773b0000 "5kB6gI2.exe" loaded module "CRYPTBASE.DLL" at base 75310000 "5kB6gI2.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cc90000 "5kB6gI2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 63d80000 "5kB6gI2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cc70000 "5kB6gI2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61040000 "5kB6gI2.exe" loaded module "ADVAPI32.DLL" at base 75930000 "5kB6gI2.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "5kB6gI2.exe" loaded module "NTDLL.DLL" at base 77510000 "5kB6gI2.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "5kB6gI2.exe" loaded module "SHELL32.DLL" at base 76520000 "5kB6gI2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 752c0000 "5kB6gI2.exe" loaded module "OLEAUT32.DLL" at base 75760000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71740000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "RegAsm.exe" loaded module "KERNEL32" at base 75a80000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "RegAsm.exe" loaded module "ADVAPI32.DLL" at base 75930000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c380000 "RegAsm.exe" loaded module "SHLWAPI.DLL" at base 758d0000 "RegAsm.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "RegAsm.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "RegAsm.exe" loaded module "VERSION.DLL" at base 748b0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 62eb0000 "RegAsm.exe" loaded module "USER32.DLL" at base 75800000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "RegAsm.exe" loaded module "MSCOREE.DLL" at base 6c410000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "RegAsm.exe" loaded module "PSAPI.DLL" at base 75750000 "RegAsm.exe" loaded module "RPCRT4.DLL" at base 75bc0000 "RegAsm.exe" loaded module "KERNEL32.DLL" at base 75a80000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61aa0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "RegAsm.exe" loaded module "OLE32.DLL" at base 773b0000 "RegAsm.exe" loaded module "CRYPTBASE.DLL" at base 75310000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74060000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cc90000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 63d80000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61040000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 63800000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5f230000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "RegAsm.exe" loaded module "UXTHEME.DLL" at base 74060000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60820000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 63ad0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 600a0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cc70000 "RegAsm.exe" loaded module "NTDLL.DLL" at base 77510000 "RegAsm.exe" loaded module "SHELL32.DLL" at base 76520000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75c70000 "RegAsm.exe" loaded module "PROFAPI.DLL" at base 75420000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "RegAsm.exe" loaded module "BCRYPT.DLL" at base 74f30000 "RegAsm.exe" loaded module "CRYPTSP.DLL" at base 74e20000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74bb0000 "RegAsm.exe" loaded module "IMM32.DLL" at base 75b60000 "RegAsm.exe" loaded module "COMCTL32.DLL" at base 71cf0000 "RegAsm.exe" loaded module "GDI32.DLL" at base 77660000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 5ee10000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 59e00000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5c960000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "RegAsm.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6a6a0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "RegAsm.exe" loaded module "DWRITE.DLL" at base 64000000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 755a0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5ebb0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5ea50000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5e770000 "RegAsm.exe" loaded module "DWMAPI.DLL" at base 73d80000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 773b0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5e460000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 68bf0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5c860000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5b600000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "RegAsm.exe" loaded module "WS2_32.DLL" at base 75b80000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74de0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74940000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74dd0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "RegAsm.exe" loaded module "SSPICLI.DLL" at base 752a0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "RegAsm.exe" loaded module "SECUR32.DLL" at base 75150000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5b4d0000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75c70000 "RegAsm.exe" loaded module "CLBCATQ.DLL" at base 759e0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75a80000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6e490000 "RegAsm.exe" loaded module "RPCRTREMOTE.DLL" at base 753b0000 "RegAsm.exe" loaded module "OLEAUT32.DLL" at base 75760000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71ed0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 5e430000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e4b0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 71fa0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5b3f0000 "RegAsm.exe" loaded module "GDIPLUS.DLL" at base 73ec0000 "RegAsm.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73ec0000 "RegAsm.exe" loaded module "WINDOWSCODECS.DLL" at base 73800000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "RegAsm.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6a75000046:T450,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "Xj6Hl21.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "SP4Rr42.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "Qf8gp08.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "Vr8oH09.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "1dP82wv5.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "2pX3090.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "powershell.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "3hL78Uj.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "4Wo403IN.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "qemu-ga.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "5kB6gI2.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC0000 "RegAsm.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75BC000047:T1097,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" was detected as "Microsoft Linker" and name: "Linker" "4Wo403IN.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Wo403IN.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Wo403IN.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Wo403IN.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Wo403IN.exe" was detected as "Microsoft Linker" and name: "Linker" "6kG0qp7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6kG0qp7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6kG0qp7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6kG0qp7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6kG0qp7.exe" was detected as "Microsoft Linker" and name: "Linker" "Qf8gp08.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Qf8gp08.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Qf8gp08.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Qf8gp08.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Qf8gp08.exe" was detected as "Microsoft Linker" and name: "Linker" "Vr8oH09.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Vr8oH09.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Vr8oH09.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Vr8oH09.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Vr8oH09.exe" was detected as "Microsoft Linker" and name: "Linker" "2pX3090.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2pX3090.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2pX3090.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2pX3090.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2pX3090.exe" was detected as "Microsoft Linker" and name: "Linker" "1dP82wv5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1dP82wv5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1dP82wv5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1dP82wv5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1dP82wv5.exe" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Microsoft Cabinet" and name: "sfx" "sqlite3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "5kB6gI2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5kB6gI2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5kB6gI2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5kB6gI2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5kB6gI2.exe" was detected as "Microsoft Linker" and name: "Linker" "3hL78Uj.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3hL78Uj.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3hL78Uj.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3hL78Uj.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3hL78Uj.exe" was detected as "Microsoft Linker" and name: "Linker" "qemu-ga.exe" was detected as "Microsoft Cabinet" and name: "sfx" "qemu-ga.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "qemu-ga.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qemu-ga.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "qemu-ga.exe" was detected as "Microsoft Linker" and name: "Linker"48:Tcd5,"1dP82wv5.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1dP82wv5.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "1dP82wv5.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "1dP82wv5.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "2pX3090.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "2pX3090.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "2pX3090.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "2pX3090.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "2pX3090.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "4Wo403IN.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "4Wo403IN.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "4Wo403IN.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "4Wo403IN.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "4Wo403IN.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "4Wo403IN.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "4Wo403IN.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")49:T1d57,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4Wo403IN.exe" file has an entrypoint instructions - "call 0x95dd18,push ebx,mov ebx, esp,push ebx,mov esi, dword ptr [ebx + 8],mov edi, dword ptr [ebx + 0x10],cld ,mov dl, 0x80,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,mov ebx, 2,add dl, dl,jne 0x95dbee,mov dl, byte ptr [esi],inc esi,adc dl, dl,jae 0x95dbda,add dl, dl,jne 0x95dbf9,mov dl, byte ptr [esi],inc esi,adc dl, dl,jae 0x95dc4c,xor eax, eax,add dl, dl,jne 0x95dc06,mov dl, byte ptr [esi],inc esi,adc dl, dl,jae 0x95dced,add dl, dl,jne 0x95dc15,mov dl, byte ptr [esi],inc esi,adc dl, dl,adc eax, eax,add dl, dl,jne 0x95dc20,mov dl, byte ptr [esi],inc esi,adc dl, dl,adc eax, eax,add dl, dl,jne 0x95dc2b,mov dl, byte ptr [esi],inc esi,adc dl, dl," "6kG0qp7.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x226db5],mov dword ptr [rax], 1,call 0x140001190,nop ,nop ,add rsp, 0x28,ret ,nop dword ptr [rax],sub rsp, 0x28,mov rax, qword ptr [rip + 0x226d95],mov dword ptr [rax], 0,call 0x140001190,nop ,nop ,add rsp, 0x28,ret ,nop dword ptr [rax],sub rsp, 0x28,call 0x1400c6eb0,test rax, rax,sete al,movzx eax, al,neg eax,add rsp, 0x28,ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ," "Qf8gp08.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Vr8oH09.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "2pX3090.exe" file has an entrypoint instructions - "jmp 0x85c492,add byte ptr [eax + ecx], dl,add byte ptr [eax], al,add byte ptr [eax], al,pushal ,call 0x85c498,pop ebp,sub ebp, 0x10,sub ebp, 0x45c488,jmp 0x85c4ae,jge 0x85c47b,test byte ptr [ebx - 0x48], ah,mov ah, al,inc ebp,add byte ptr [ebx], al,lds eax, ptr [ecx + 0x4cc0],add byte ptr [ecx + 0x5fa], bh,mov edx, 0xb5227753,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0x85c4c5,jmp 0x85c4d8,and eax, 0xd88bd656,sahf ,fcomp st(2),outsd dx, dword ptr [esi],push ebx,push ebx,push ebx,rcl byte ptr [edx + 0x535353ab], cl,push eax,sahf ,jmp 0x85c541,push ebx,push ebx," "1dP82wv5.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "sqlite3.dll" file has an entrypoint instructions - "jmp 0x100a9752,jmp 0x10084dd0,jmp 0x10083310,jmp 0x100a7460,jmp 0x100a8840,jmp 0x10084c70,jmp 0x10082e10,jmp 0x10086cc0,jmp 0x10089a90,jmp 0x100824e0,jmp 0x100867c0,jmp 0x10086020,jmp 0x10084340,jmp 0x100a9f11,jmp 0x100aa3db,jmp 0x100a86ef,jmp 0x10088a80,jmp 0x10089260,jmp 0x10089c60,jmp 0x100a9d91," "5kB6gI2.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "3hL78Uj.exe" file has an entrypoint instructions - "call 0x4031a7,jne 0x4031af,je 0x4031af,jnp 0x403153,and dword ptr [ecx - 0x74fb3b7d], ecx,pop esp,and al, 0xfc,jmp 0x4031c2,add al, 0x81,jmp 0x403163,xor dword ptr [eax], eax,add bl, ch,add eax, 0x4f5eb20,and byte ptr [edi + eax + 0x75], dh,add eax, 0xb1d340c7,rol bh, 1,inc esp,and al, 0xfc,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x4031e2,je 0x4031e2,int3 ,dec esi,xchg eax, esi,add eax, dword ptr [ebx + 0x548b04c4],and al, 0xfc,jmp 0x4031f1,add al, 0x29,shr bl, 5,add ch, bl,stc ,add al, 2,jmp 0x4031fc,or byte ptr [edx], cl,loop 0x403246,mov byte ptr [ebx + eax + 2], ah,je 0x403206,jne 0x403206,mov cl, 0xb5,dec edi," "qemu-ga.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"4a:T469,Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-vfiteakchuq/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-vfiteakchuq/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSdet-vfiteakchuq/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSdet-vfiteakchuq" [Source: QCI109FM1B56WI60S0PS.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00002716-00000C28-6894515250]4b:T8b3,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Xj6Hl21.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Xj6Hl21.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SP4Rr42.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SP4Rr42.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Qf8gp08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Qf8gp08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Vr8oH09.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Vr8oH09.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1dP82wv5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1dP82wv5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1dP82wv5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2pX3090.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2pX3090.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2pX3090.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")4c:Tebe,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002404.00000964.626575.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003932-00000C25-37165130] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003932-00000BC1-37176634] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003932-00000C25-112625344] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003932-00000C25-112810130] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00003932-00000C25-112895658] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003284-00000BC1-38177279] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00002420-00000BC1-39101290] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00002404-00000BC1-39605351] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00002408-00000BC1-40624804] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00002416-00000C25-41804543] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000720-00000C25-48414382] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00000720-00000C25-48552673] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00000720-00000C25-48895026] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000720-00000C25-48986347] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00000720-00000C25-49148198] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00000720-00000C25-49201059] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00000720-00000C25-49363157] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000720-00000C25-49605980] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000720-00000C25-49663582] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll" [Source: 00000000-00000720-00000C25-49703550] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00000720-00000C25-49904197] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00000720-00000C25-50131888] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00000720-00000C25-50177653] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00000720-00000C25-50280288]4d:T7a0,Spawned process "Xj6Hl21.exe" (UID: 00000000-00003284) Spawned process "SP4Rr42.exe" (UID: 00000000-00002420) Spawned process "Qf8gp08.exe" (UID: 00000000-00002404) Spawned process "Vr8oH09.exe" (UID: 00000000-00002408) Spawned process "1dP82wv5.exe" (UID: 00000000-00002416) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00000280) Spawned process "iexplore.exe" with commandline "https://facebook.com/login" (UID: 00000000-00002252) Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00003460) Spawned process "iexplore.exe" with commandline "SCODEF:280 CREDAT:275458 /prefetch:2" (UID: 00000000-00003232) Spawned process "iexplore.exe" with commandline "SCODEF:2252 CREDAT:275457 /prefetch:2" (UID: 00000000-00002728) Spawned process "iexplore.exe" with commandline "SCODEF:3460 CREDAT:275457 /prefetch:2" (UID: 00000000-00003240) Spawned process "2pX3090.exe" (UID: 00000000-00000720) Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00002716) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00002348), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00000820) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00002160), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00000728) Spawned process "3hL78Uj.exe" (UID: 00000000-00002968) Spawned process "4Wo403IN.exe" (UID: 00000000-00001300) Spawned process "qemu-ga.exe" (UID: 00000000-00001704) Spawned process "5kB6gI2.exe" (UID: 00000000-00003436) Spawned process "RegAsm.exe" (UID: 00000000-00003360)4e:T7a0,Spawned process "Xj6Hl21.exe" (UID: 00000000-00003284) Spawned process "SP4Rr42.exe" (UID: 00000000-00002420) Spawned process "Qf8gp08.exe" (UID: 00000000-00002404) Spawned process "Vr8oH09.exe" (UID: 00000000-00002408) Spawned process "1dP82wv5.exe" (UID: 00000000-00002416) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00000280) Spawned process "iexplore.exe" with commandline "https://facebook.com/login" (UID: 00000000-00002252) Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00003460) Spawned process "iexplore.exe" with commandline "SCODEF:280 CREDAT:275458 /prefetch:2" (UID: 00000000-00003232) Spawned process "iexplore.exe" with commandline "SCODEF:2252 CREDAT:275457 /prefetch:2" (UID: 00000000-00002728) Spawned process "iexplore.exe" with commandline "SCODEF:3460 CREDAT:275457 /prefetch:2" (UID: 00000000-00003240) Spawned process "2pX3090.exe" (UID: 00000000-00000720) Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00002716) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00002348), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00000820) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Of ..." (UID: 00000000-00002160), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offi ..." (UID: 00000000-00000728) Spawned process "3hL78Uj.exe" (UID: 00000000-00002968) Spawned process "4Wo403IN.exe" (UID: 00000000-00001300) Spawned process "qemu-ga.exe" (UID: 00000000-00001704) Spawned process "5kB6gI2.exe" (UID: 00000000-00003436) Spawned process "RegAsm.exe" (UID: 00000000-00003360)4f:T6168,"Xj6Hl21.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Xj6Hl21.exe]- [targetUID: 00000000-00003932] "SP4Rr42.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\SP4Rr42.exe]- [targetUID: 00000000-00003284] "4Wo403IN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4Wo403IN.exe]- [targetUID: 00000000-00001300] "6kG0qp7.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- Location: [%TEMP%\IXP000.TMP\6kG0qp7.exe]- [targetUID: 00000000-00003932] "Qf8gp08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Qf8gp08.exe]- [targetUID: 00000000-00002404] "Vr8oH09.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Vr8oH09.exe]- [targetUID: 00000000-00002404] "2pX3090.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2pX3090.exe]- [targetUID: 00000000-00000720] "1dP82wv5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1dP82wv5.exe]- [targetUID: 00000000-00002408] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\tempAVS4CE6aJWI15Cd\sqlite3.dll]- [targetUID: 00000000-00000720] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "5kB6gI2.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP001.TMP\5kB6gI2.exe]- [targetUID: 00000000-00003436] "3hL78Uj.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3hL78Uj.exe]- [targetUID: 00000000-00002404] "qemu-ga.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe]- [targetUID: 00000000-00001704] "4lCu2zih0ca_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Thu Jan 4 13:42:28 2024 mtime=Thu Jan 4 13:42:28 2024 atime=Thu Jan 4 13:16:32 2024 length=1527296 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00000720] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "K1UB32KQ.js" has type "ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\K1UB32KQ.js]- [targetUID: 00000000-00003232] "HQECIU84.js" has type "ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\HQECIU84.js]- [targetUID: 00000000-00003232] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "qczqs7QMr3-_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m__b__tp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "V0MSDWKU.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\V0MSDWKU.htm]- [targetUID: 00000000-00000280] "m_ltDFwf_Rusgnf_Ctsu_UPKV3d_bPkrc_W2YXuc_pxq3x_IZ1fbc_soHxf_kSPLL_qPfo0c_yRXbo_bTi8wc_ywOR5c_PHUIyb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "6bjw9N12j0I_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_2_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "urlref_httpsfacebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "xGzxHIbkRpC_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "sKtrEJAtiUM_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Br6EHF-GHmg_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Ch_YChJCKQS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_byfTOb_lsjVmc_LEikZe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "_BJqgRg0BU5_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "aBIoq18cchP_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "0c3LcPcNMEz_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "qvzskUrYlYC_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00000280] "_B0FA5BC7-AB06-11EE-9046-00505691C0FA_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_2_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DF0E1FAD28246A157D.TMP" has type "data"- Location: [%TEMP%\~DF0E1FAD28246A157D.TMP]- [targetUID: 00000000-00000280] "KFOmCnqEu92Fr1Mu4mxM_1_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "Jn0xcQmjzFV_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "m_RqjULd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "L3lExXePTzJ_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 18412 version 1.1"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00000280] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003232] "~DF65F0B86A83646144.TMP" has type "data"- Location: [%TEMP%\~DF65F0B86A83646144.TMP]- [targetUID: 00000000-00000280] "~DFA1255C1B617C0477.TMP" has type "data"- Location: [%TEMP%\~DFA1255C1B617C0477.TMP]- [targetUID: 00000000-00002252] "~DF714101D1ECBA440F.TMP" has type "data"- Location: [%TEMP%\~DF714101D1ECBA440F.TMP]- [targetUID: 00000000-00002252] "~DF3716ED5E1A9CF30E.TMP" has type "data"- Location: [%TEMP%\~DF3716ED5E1A9CF30E.TMP]- [targetUID: 00000000-00003460] "~DFC4444F6D1EA40154.TMP" has type "data"- Location: [%TEMP%\~DFC4444F6D1EA40154.TMP]- [targetUID: 00000000-00002252] "~DFD524D56AC6791FF5.TMP" has type "data"- Location: [%TEMP%\~DFD524D56AC6791FF5.TMP]- [targetUID: 00000000-00003460] "~DF876481A8A8ED3509.TMP" has type "data"- Location: [%TEMP%\~DF876481A8A8ED3509.TMP]- [targetUID: 00000000-00000280] "C88418EDBE65AF3960916D9E8011370D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00003232] "HtdXy-2D6mm_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "_DBF4DD47-AB06-11EE-9046-00505691C0FA_.dat" has type "Composite Document File V2 Document Cannot read short stream"- [targetUID: N/A] "m_wg1P6b_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "ysfm_2i9xtW_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "EVmD_liOmwc_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._B148F8E0-AB06-11EE-9046-00505691C0FA_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._B0FA5BC5-AB06-11EE-9046-00505691C0FA_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._B0FA82D5-AB06-11EE-9046-00505691C0FA_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "RKK6hMCj3R1_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000280] "_DB62FD84-AB06-11EE-9046-00505691C0FA_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F1BEB224-AB78-11EE-9046-00505691C0FA_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_6F137752-AB07-11EE-9046-00505691C0FA_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "m_sOXFj_q0xTif_ZZ4WUe_1_.js" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "dberr.txt" has type "ASCII text with CRLF line terminators"- Location: [%WINDIR%\System32\catroot2\dberr.txt]- [targetUID: 00000000-00003232] "m_Wt6vjf_hhhU8_FCpbqb_WhJNk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_ZwDk9d_RMhBfe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "M08arqdo_nN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_w9hDv_VwDzFe_A7fCU_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_bm51tf_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003232] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "Atn6-5S2M-o_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CbM6CZG2ZAb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "0AB67BD4882FB0E09822529CFEB33A58" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00000280] "favicon_3_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "3FPJ9YC_wUr_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "GIlJjyzEguQ_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "A3tiDdwKtg5_1_.css" has type "ASCII text"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003232] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003232] "MF7C6RNT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\MF7C6RNT.txt]- [targetUID: 00000000-00000280] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003232] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00000280] "35DDEDF268117918D1D277A171D8DF7B_5EB1CBA003F9559FC0FD2BE8FBD6D2B1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_5EB1CBA003F9559FC0FD2BE8FBD6D2B1]- [targetUID: 00000000-00002728] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003232] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00003232] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00000280] "35DDEDF268117918D1D277A171D8DF7B_CEAEC54FF3AD732862C0691CA17A76C5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_CEAEC54FF3AD732862C0691CA17A76C5]- [targetUID: 00000000-00002728] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002728] "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced"- [targetUID: N/A] "LDFDUeRDitE_1_.js" has type "ASCII text"- [targetUID: N/A] "X9V7UQSH.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\X9V7UQSH.txt]- [targetUID: 00000000-00000280] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "35DDEDF268117918D1D277A171D8DF7B_5EB1CBA003F9559FC0FD2BE8FBD6D2B1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_5EB1CBA003F9559FC0FD2BE8FBD6D2B1]- [targetUID: 00000000-00002728] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00000280] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003232] "35DDEDF268117918D1D277A171D8DF7B_CEAEC54FF3AD732862C0691CA17A76C5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_CEAEC54FF3AD732862C0691CA17A76C5]- [targetUID: 00000000-00002728] "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003232] "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00003232] "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003232] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00000280] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002728] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003232] "FHNHI61G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FHNHI61G.txt]- [targetUID: 00000000-00002728] "TI6FOHGS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\TI6FOHGS.txt]- [targetUID: 00000000-00003232] "N0A62UDY.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\N0A62UDY.txt]- [targetUID: 00000000-00003232] "css_3_.css" has type "ASCII text"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000280] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "Q40N8Z50.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Q40N8Z50.txt]- [targetUID: 00000000-00002728] "8B44W1LU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8B44W1LU.txt]- [targetUID: 00000000-00002728] "JJIG3WB7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\JJIG3WB7.txt]- [targetUID: 00000000-00002728] "2NH00RO3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2NH00RO3.txt]- [targetUID: 00000000-00000280] "YYOI124G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\YYOI124G.txt]- [targetUID: 00000000-00003240] "8A7891822FCFF127E4EADADE9757112B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00000280] "0AB67BD4882FB0E09822529CFEB33A58" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00000280] "SLWC5O6C.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SLWC5O6C.txt]- [targetUID: 00000000-00003232] "JRZDB31O.htm" has type "gzip compressed data original size modulo 2^32 338"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\JRZDB31O.htm]- [targetUID: 00000000-00003232] "4BO66MLW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\4BO66MLW.txt]- [targetUID: 00000000-00003232] "WQUKW947.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\WQUKW947.txt]- [targetUID: 00000000-00003232] "I16NKU1B.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\I16NKU1B.txt]- [targetUID: 00000000-00003232] "UO4P8IJO.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\UO4P8IJO.txt]- [targetUID: 00000000-00003232] "6B5G4YZB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6B5G4YZB.txt]- [targetUID: 00000000-00003232] "3NV0WPIK.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3NV0WPIK.txt]- [targetUID: 00000000-00000280] "8KAAB57S.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8KAAB57S.txt]- [targetUID: 00000000-00002728] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003232] "C88418EDBE65AF3960916D9E8011370D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00003232] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003232] "BEGEX59H.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BEGEX59H.txt]- [targetUID: 00000000-00003240] "33K5FST4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\33K5FST4.txt]- [targetUID: 00000000-00000280] "log_4_.txt" has type "ASCII text with no line terminators"- [targetUID: N/A] "OKOP42RM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OKOP42RM.txt]- [targetUID: 00000000-00003232] "8VUGE0QM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8VUGE0QM.txt]- [targetUID: 00000000-00003232] "FTE1JRTJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\FTE1JRTJ.txt]- [targetUID: 00000000-00003232] "W6KEC8RI.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\W6KEC8RI.txt]- [targetUID: 00000000-00002728] "L5P51BJJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\L5P51BJJ.txt]- [targetUID: 00000000-00000280] "5FEETCY0.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5FEETCY0.txt]- [targetUID: 00000000-00003232] "HMQQ8DNU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HMQQ8DNU.txt]- [targetUID: 00000000-00000280] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "9PUV5RKB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9PUV5RKB.txt]- [targetUID: 00000000-00000280] "LXBAKUOW.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LXBAKUOW.txt]- [targetUID: 00000000-00003240] "QT642WQB.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\QT642WQB.txt]- [targetUID: 00000000-00000280] "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00000720] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00000720] "OfficeTrackerNMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00000720] "MaxLoonaFest131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00000720] "8A7891822FCFF127E4EADADE9757112B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00000280] "7W8ASTWJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\7W8ASTWJ.txt]- [targetUID: 00000000-00000280] "E6JTML7O.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\E6JTML7O.txt]- [targetUID: 00000000-00000280]50:T974,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")51:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")52:T4c2,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" queries basic process information of the "C:\Windows\System32\en-US\KernelBase.dll.mui" (UID: 3932) "Xj6Hl21.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3284) "Xj6Hl21.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3284) "SP4Rr42.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2420) "SP4Rr42.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2420) "Qf8gp08.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2404) "Qf8gp08.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2404) "Vr8oH09.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2408) "Vr8oH09.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2408) "2pX3090.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp\FANBooster131\FANBooster131.exe" (UID: 720) "5kB6gI2.exe" queries basic process information of the "C:\Windows\System32\tzres.dll" (UID: 3436)53:Te12,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "2F3C9BE60064DEB5A63A27F1C4E50CC0"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "2f3c9be60064deb5a63a27f1c4e50cc0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")54:T4b5,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\xj6hl21.exe" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" reads file "c:\windows\fonts\staticcache.dat" "Xj6Hl21.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\sp4rr42.exe" "Xj6Hl21.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5kb6gi2.exe" "SP4Rr42.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\qf8gp08.exe" "SP4Rr42.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4wo403in.exe" "Qf8gp08.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\vr8oh09.exe" "Qf8gp08.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3hl78uj.exe" "Vr8oH09.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\1dp82wv5.exe" "Vr8oH09.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\2px3090.exe" "1dP82wv5.exe" reads file "c:\windows\system32\ieframe.dll" "1dP82wv5.exe" reads file "c:\program files\internet explorer\ieproxy.dll" "1dP82wv5.exe" reads file "c:\program files\internet explorer\iexplore.exe" "2pX3090.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\2px3090.exe"55:T95a,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\2f3c9be60064deb5a63a27f1c4e50cc0.exe.Local\" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Cabinet.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\VERSION.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\SspiCli.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\WINSPOOL.DRV" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\MPR.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\MPR.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\UxTheme.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\WINMM.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\samcli.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\Windows\system32\samcli.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to touch file "C:\MSACM32.dll"56:T497,"2pX3090.exe" trying to access LNK file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBOOSTER131.LNK" "2pX3090.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" "2pX3090.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBOOSTER131.LNK" "2pX3090.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" "powershell.exe" trying to access LNK file "\Device\HarddiskVolume2\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk" "powershell.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk" "powershell.exe" trying to access LNK file "Z:\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk" "powershell.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk"57:T88f,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\Cabinet.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\VERSION.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\SspiCli.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\MPR.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\UxTheme.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\WINMM.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\samcli.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\MSACM32.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\sfc.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\sfc_os.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\dwmapi.dll" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Xj6Hl21.exe" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6kG0qp7.exe" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"58:T991,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\2f3c9be60064deb5a63a27f1c4e50cc0.exe.Local\" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\2f3c9be60064deb5a63a27f1c4e50cc0.exe.Config" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\2F3C9BE60064DEB5A63A27F1C4E50CC0.EXE.LOCAL" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\2F3C9BE60064DEB5A63A27F1C4E50CC0.EXE.CONFIG" "2f3c9be60064deb5a63a27f1c4e50cc0.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Xj6Hl21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Xj6Hl21.exe.Local\" "Xj6Hl21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Xj6Hl21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Xj6Hl21.exe.Config" "Xj6Hl21.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Xj6Hl21.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\XJ6HL21.EXE.LOCAL" "Xj6Hl21.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Xj6Hl21.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\XJ6HL21.EXE.CONFIG" "Xj6Hl21.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "SP4Rr42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\SP4Rr42.exe.Local\" "SP4Rr42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "SP4Rr42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\SP4Rr42.exe.Config" "SP4Rr42.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"59:T40f1,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:t-8GqXfWKuiKt04w0SQjYrGDs-OIFw:_ilPkGTZqUcO5NYIConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2G_vYbIR2X93X7V-pCAe9iMnDZucA87L1SNsBVfZgOKn0I-qZIvRzm8cmoi4PIuZOIoQLvcQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:t-8GqXfWKuiKt04w0SQjYrGDs-OIFw:_ilPkGTZqUcO5NYIConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-cLK4Lw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1543359670%3A1704379197917920&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:t-8GqXfWKuiKt04w0SQjYrGDs-OIFw:_ilPkGTZqUcO5NYIConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-5638156492532584744&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=53205&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-1543359670:1704379197917920",null,null,"ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-cLK4Lw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:E7wYmk19n6McS-l3EBiKBVSTu3hAgw:9bfez4EVCd0mGUsR"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:E7wYmk19n6McS-l3EBiKBVSTu3hAgw:9bfez4EVCd0mGUsR"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:I667FaTPiM1yEmcw2oB4NJxjVjStSQ:K7A7wzCPkq2dxShU"; in File: "SSL") Found requests in header "GET /generate_204?WM1WfA HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:I667FaTPiM1yEmcw2oB4NJxjVjStSQ:K7A7wzCPkq2dxShU"; in File: "SSL") Found requests in header "GET /restart?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1543359670%3A1704379197917920&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-cLK4Lw&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:I667FaTPiM1yEmcw2oB4NJxjVjStSQ:K7A7wzCPkq2dxShU; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-cLK4Lw&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:9H4F-WtJWrplXDaS247vHGz-E6OM0Q:AJjNybmN-fOJBxau; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZUConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-cLK4Lw&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:9H4F-WtJWrplXDaS247vHGz-E6OM0Q:AJjNybmN-fOJBxau; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH28P-Be3sOATYlw&theme=glif&dsh=S-2029126278%3A1704379268433769 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9H4F-WtJWrplXDaS247vHGz-E6OM0Q:AJjNybmN-fOJBxau; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9H4F-WtJWrplXDaS247vHGz-E6OM0Q:AJjNybmN-fOJBxau; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-8552895749750974679&bl=boq_identityfrontendauthuiserver_20231210.08_p0&hl=en-US&_reqid=75223&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-2029126278:1704379268433769",null,null,"ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH28P-Be3sOATYlw"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:9H4F-WtJWrplXDaS247vHGz-E6OM0Q:AJjNybmN-fOJBxau; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9H4F-WtJWrplXDaS247vHGz-E6OM0Q:AJjNybmN-fOJBxau; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /generate_204?un6vpQ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:up5quyGmIoYRdP6ntgqZmsqF4rzJew:GLwdORqVIFIfMPuq; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /restart?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-2029126278%3A1704379268433769&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH28P-Be3sOATYlw&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:up5quyGmIoYRdP6ntgqZmsqF4rzJew:GLwdORqVIFIfMPuq; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH28P-Be3sOATYlw&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:JwmPq_LA6go12nOUzoKXw7Pu28aNMA:M9rPo3qsCxMPDi5p; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZUConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3thYj5fNfK3z4V6drDirELniAcbRuQlT5M7te4u_GjMj-Fjtr3IbnXSnI0_DD4lydjNXVWSg&theme=glif&dsh=S-351729661%3A1704379337859748 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:JwmPq_LA6go12nOUzoKXw7Pu28aNMA:M9rPo3qsCxMPDi5p; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH28P-Be3sOATYlw&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:JwmPq_LA6go12nOUzoKXw7Pu28aNMA:M9rPo3qsCxMPDi5p; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:JwmPq_LA6go12nOUzoKXw7Pu28aNMA:M9rPo3qsCxMPDi5p; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-5918656526683681778&bl=boq_identityfrontendauthuiserver_20231231.08_p0&hl=en-US&_reqid=21805&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-351729661:1704379337859748",null,null,"ASKXGp3thYj5fNfK3z4V6drDirELniAcbRuQlT5M7te4u_GjMj-Fjtr3IbnXSnI0_DD4lydjNXVWSg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:JwmPq_LA6go12nOUzoKXw7Pu28aNMA:M9rPo3qsCxMPDi5p; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:JwmPq_LA6go12nOUzoKXw7Pu28aNMA:M9rPo3qsCxMPDi5p; OTZ=7367867_52_52_123900_48_436380; NID=511=BW663WK3iqbzuACqD50CBkKx7JG3ehC7STIx1MrAft_93DOwvBo-gs1Iy39nQ8GTzRa4NdcFG1zhlsCWRz06tpaO_W7-q52KgkL4uqaPzoJHr1U_ZL6DJ2e6icQLF_g9Y6wNKSGmmDpgSsMFkemAegAhzLVc5ED72CswD0ua7ZU"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif?c=2.5 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: fbcdn.net"; in File: "SSL")5a:T9018,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:t-8GqXfWKuiKt04w0SQjYrGDs-OIFw:_ilPkGTZqUcO5NYIConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:t-8GqXfWKuiKt04w0SQjYrGDs-OIFw:_ilPkGTZqUcO5NYI;Path=/;Expires=Sat, 03-Jan-2026 14:39:57 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-gtsjk6XAwmpkkgYhzPHYZQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Thu, 04 Jan 2024 14:39:57 GMTExpires: Thu, 04 Jan 2024 14:39:57 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "000000010000001�eb��PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Thu 04 Jan 2024 14:39:57 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2G_vYbIR2X93X7V-pCAe9iMnDZucA87L1SNsBVfZgOKn0I-qZIvRzm8cmoi4PIuZOIoQLvcQStrict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Cross-Origin-Opener-Policy: unsafe-noneContent-Security-Policy: script-src 'nonce-e58hnnmOfm4elQN3PdXDlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportCross-Origin-Resource-Policy: cross-originAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2G_vYbIR2X93X7V-pCAe9iMnDZucA87L1SNsBVfZgOKn0I-qZIvRzm8cmoi4PIuZOIoQLvcQ HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:t-8GqXfWKuiKt04w0SQjYrGDs-OIFw:_ilPkGTZqUcO5NYIConnection: Keep-AliveAccept-Language: en-US", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-cLK4Lw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1543359670%3A1704379197917920&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:t-8GqXfWKuiKt04w0SQjYrGDs-OIFw:_ilPkGTZqUcO5NYIConnection: Keep-AliveAccept-Language: en-US", "H��Hҷ��D�o��w��obN��b�_S��p-=w��lƭ��WK��0��??|99�臡��j�L�ܝ�'��Z��x�^��ƺw3�ŕ�:��/A��\~wL}�7�#Xa��:Q��[2b<+��׌�S:�#��%�8��q۟��>�;��uU^�B��ٍKL|��,N�v�6��w�kS��4q�U>��I6��Y1��-[��h�X� �S�@��w��^��t}UA��M��9�n�q�P��V��A��3�Y�+��/��`:\��r�l��U��_�c�)�k��tڿ�g�h�� Q��j-R9�8N��>&��҃ϩ9헋�x)�y��l�S��U<2�ױ�$@�*��P#(M6�_�}��r7�^'��e%�0.=6Ҟ�M�]6NW|7g?��gG}HC��/M��߃V�M�%��Z��3_��ۯ��XD��K��HI�u��(*<��oR��2}�<�rV�+%�"�,0��Ӏ}:�*o��}EP�/��3��1K?�B|1dy��1)��<��FS�M\��Py�Ρ�@S��ՌaK��uaa��@_��d$%[KZ��"O>��f�#k��o��t1�&�g�H�p��9��O��]��!��H/��*��"u�]*!*��f�u�J/~Mr�-Ɖ��ʫ��W�S�o8O�pן�w��lxC��o(S�@1��,Q3觲T�y{�C/6�wd4��:p�;�(�* Zs��4��*B��{�./TW��n�k��og�Ċ�3��b�~k�PE�L�N��[�n�]�H�]t��?.��i�L��h�e��"*�|e6�M��O�2�p�IP�oBg��:�pLҟ�� ۏ��7��`�fm�P��H�V,M�)��@��S��iٜ�XXo�s�2".rw��k9s뮋9�I�"%W9�Z��C��F)$��cvx��^Ǻ��0[-fYd�u8_��K��'�V�gq7��R��,��Z�Ap[y��;��=v�w��+[+he�V%�~|W��.��w6��K�0\�Lq�R+��{�߇,��_�ϒ'�", "pGI:\M��G}s8M��@�i��s�>]_&�3�Y-�q��~�|�f��C�?��~��H{M�@F��:��", "00000001�00000001]00000001�00000001�00000001�0000000160001cdb�Wܗ3`-$�^;�臶Y7M�h��6�~�3�D^��Ǘ$R|%Zq ɮDG?��!g��R!�a��ȶxJ�2��`�C�1�|ی�!��0ڕ{�c�$�QU]Ö��"x��[��[q��Џ�D��M�H��t�C�-Z*�C��^�UG��q��}��.ψ��*Epr�+=W O0��J>��\��s�Q] A��ΜT�)�pϋ��d�ʐf-He�&G�^�esc�`��T�4��c�CvRJ��c�tN��1�c�x`�"�.�(V��>�!�k٨��#`�m)�ђ)�s=��Tzm]`P��8Ё�ք*Ǫ��W�/�V9[��r�d�PH�@�Oi�j��6��_@s;��6��1=g+��22d8�lG�4��9�g�H��1�C6I�փ~�dg�Ʀ3qR}R�876�SWn��gUˍRk�f��乼�qb�M)�nGt�k�;h5��̾��tOx�{��v�W��R�k��5+s�C}��%�B'��s�1sjϨ�C��?��煫3X�,��H��Hc��ٗ$��R��aW�R�c��3vN6D��P��\]��ƗJuF�b�!w��"Q[T�$��g/do��"g��'�t��e�^�!B��w�ѐ۝6Ȥ�v�v�.�߽��Ć��!o�?b�spy7N�� }��V��ҪĚJ8��NcC��Ow�}Oˍ�b5�|��=�[9��Hx�r�E%K�~B�v;�r�H��(�>��`��-��}*�1d��+��R��2�]��֦T��F�R.?}n��Y؟v�G��?�3��J��G�t��r�S;��Q�H�)¦��UN�*+� ǠM��t��R�L�K=�r��y�TxȖc�@�}�n9N�5��5T}��k%�A��j�L�Ч�+�T�)�ߙ��c(�V��a�&l�>߈)��vს�0�a��W��1 �O5@X�&��|��h��hZ��0Rc~Ρ��}�c��2R�N��F��V�)��%��0~H܊+�i�Y�<�J<9�<#��lh��{l��E�Tx��~p�*[{B�U��Qx�['��k� ��Ya5>��Z�㎚׺<�� ACRrG�1Kl�Pr]��Y�k��v#�q��}Ʉ��dr��S�e��v�� W�j̝�-µɐkS��m�S��p��Q�06n&Z�ɨQ��Av�6'E��>��5��]�@�k�^G�[�)庸Ra�U�>/�qc&�M�n:h#��B/.�pл�Ȗ��C�-�x;��/z��In�a+�Nu ^��L�b4�.�g�<��YqBMEJuZIEڜj�u��6�[�"�J_��{ry�9��r=]��ag�} �>��R!��=��eQ�m4��q�h��c�m�*��]zM��'5��,|��f�Z�6��ts��ï�`�nru�I*]��d��6Rw!�L�b��6at��n��v�${ʧE�g}'�N0�.i��ų��ֻd��Ai&��/oJ*+��\#��6}�qy25�v=}��w��ӏqN��e�M�˛۠xѓk�j�D�w�Q)��J��z�"�y�L��ۄ�@�6�m�s�كdc��wvg��n�T(��a3�H[]��E|�v%oȠLTʞ��.l�ޮ{>�}T)@��Aʄ��U�{\�z={֛�`�@�ƛ د7��k�O�d!c��R)0�ɒi�L�*圼ZM�I�x��l�mz{��v�Jx�A��ݠF�׏�Y�d�2��=eQ��)�$�i�k�WH�4��i��Y�qE{�:��>��2~��G��!IŐ�~��w�I�菆�I�O�t� �f:dz�k(6lE�2�I�-T��F��N��c��(��G:O2K��-,�=��u�d<�j�:aa�K�G<�K]ҫ�G�i�o��j��2��<�Ž{.�My��W��_��պ*��0�50L�Oz^��-"��k1��x:�w�Eg/�8��^c:��˧ْJXsjyu�4A�P��?�Q�{��R^RV�p�R.��%c��O#��Z�x��j��t#I��w��?*gԓq#ͪ�{��S��W߈cQT���4�\i�ӫk��h�M��S�+�2�<�rg��+oV�wrۥ��H9�T5�N�b��r�k#"�5*�\�]�bHI�p5��n�0�Ԏ��Cv,v�,6�ha{$=", "[-��AE�(��`��(��졑%Pcy�qöOufA��3�^��.�p��W΂@8��J�Ww+��b8�p��pzy7�\��z��yA�!9b�70j�a��3f��%V��օ��!�`��]r��Pm��x5�f�y9ςU��ǹa��p�3aCa�0sۥ�ɷ:3�� d�v�n<��|�>��p:MG��l�S��A8OB�s'�5<8#��B�t'Ѣ��pN�)^ 4��y �D@�H+S�Ы�?F�`u{��ݣ��O�� ǭP�i�&[��ƥ��6Csr�Vh\s+T`θ��7C>�[��ۡy��h�[�FϢM�Ё҃yǌ4L�\�l��|[��_�i��'{��P��׭�ͱ�,U.gH0�+7�nP/N��=ۀ�*��^��T��NX��0�c��/��YnPs��9�'��V��L�Ld΁��k05��C�j�~��OU�~�Qu�_U�~v�d�-jw9Q �{@Խ�D��@Խ��T�F_��", "00000001�00000001]00000001Y00000001s00000001�00000001H0000000100000001�00000001+00000001�00000001�00000001*00000001�00000001Z00000001�0000000100000001�00000001�00000001�00000001�7f1�%��N��)��B�W��E��FC��8K��k���9��R�p��w]ǅ�� >6��:��× �:*� BM�*��L�j�;��F��2fW@�a`b��P\��fί�g��_�&�vd�X��ң8v#U�\O�A��^!M��#�2�?1�ԩ��P�9:s�u��t�Qׅ8G�5��"w�o*�!��9�&s��?b�E��2zή��`|%�\.?��[/�`٥�x��?�/�%.��?o��KЖ��rd�j$�W-I�+��֤_��3�?˿e�KyH$V�\}=�5*��#��1+@��b�&H׻A0��s��S{��f ]�OA�JB��fI��锵�f�`�*Z�h��q��Ҏ7��s�ľ?ؾ?��`��&1|��\i��(O��(�A�xs��2�2��^��PoJ��2_�O?��}V.�;�2goFm��Y�6MSd�<��a��|��&�dCP��2��5uXCpx�5��O��d[��ˑ�2m�SE>a3��$S�\7<��Vb�O3�u4��܇��Jw��qͮ�g��~u��N�݋��ρ_mH��.~_�t_�T�6�t��GQI۝", "Hx΅�H� ��X�7s?�`��X��|+f�,�<��s ��H�H�`�^,��<�-�S*�M@��`�SеK��U�<��kLzr�FJ>אA��I��U!�_\��T6M)�w��ܶ�6+�޲9�c�-�ل��) �P��PG�K�-�Y��]�P�?��˟\Ճ�?KP��B��I��~�Ǜ��.��V��y�?�^nd�|�+L~�$ݹc��q�{}i��Bg�U�W��>_Ɨ|��:|֢֫_�o��gC��؝��Jm�.�p�h��} ]��"�ٶ��N�Z�+o|��v,��,�!�Y��١G˂��;E�B�V��9?��G�|MF?�Ɏ��ySv�4�&B��0��V�ԓ�k[Y��l<�_�8�m�ږ��қl��뇳�~RO��Ȼ�z��\�2�`��<�{X��:��Oν��u�Oۧ��?؄��*��#J|"��$��N;��Kt�z�&��Scn�dzk'ᝉo�Α4��*�ܢן?�ÛM��TAM��fԆ�z0�6�!��)C;1=��(�v_H� ��l��4��)q��d>�RVI�Y>>��#��a$C�a��KZ�pJ�f��I��>��V��Z�:-j�N��ji��&��5�$Rtk��@3��Jg��,�έ�S�ϻ�� 8�g9��xB��Kb�1�V�hf�9�$X�Q!Zɝ��s`��<4K��:��@5��s?��S9N�H��F�>4�]��%��W�!��%�bN��+�!��8��=�)`?�)��", "00000001�00000001�00000001M00000001o00000001�0000000180656��J. ��m/{Xlw��no��&F\ɰ��G��Z�[="��r��r��c��xQ��q��@>v��h�f%��K��ۚ�N�֍e��7�W��㢒!!�:D3 2$7�LUM�o��!Վ��{�6��!1Di�!��E��-d�P#C�-�ͭ��Y�=2d:�K��部�FH��'5Pw�(QwŽ�GQ�0@-�Alѻ��o��bKrsk��jVyO�ߘN��y�3*��>@B4�7�QX�Q��o��o��k��9z�0@�� $7��o�f%��:�&�"f3gfG��×�k��(I�a$�%y��P]�W��$Վ+N2\�0KP˩[��B��$�5��ؒ��;K��@�c�$ӱ\�4�wE�5B��QD3 Z�Β��='��D�g��Վ��̺�rŦ��N�'��U�-z�|!s�x`�OBlInn��'U�J -3��eKs�kT�$$�O��ɖ�� 4��F�%1@#`K��%��E��/d�[PcK�-�ͭ��Y�=�d:�˖�<��lIH��-��}��[$�A�J��K�jib��bKrsk�x�jVyO/�N��ӂYtiE3?^T��&��}/D�8Zkz��ތ8X�rp>�6�]W��[�(�E�b"��u��VؑFiz�*,�^�ނD��O��j�^��P�r1�T�K�Wp�_,��\��mN�Ry�sdM��Ǳ.�K?ϫR�4X��@ԥ�=\��m�b��u�FP�z��;EطJ��ys�،�[3�fƓu�13��x3�y�OlƇ��d�s�MJ��WQoʸ�Y�[=S��1).�)u2~�-g@�:��ݬVGj7��{��9/i��c�y��|i�l�U~��{�h�/�W��M��cC��q[~+��V�i�ɪ2��+#=�O{9��D=�P�:��Y�Ql��:��o1��K��L�%��%K�� 1n��ĸA��/K�� 1nH�Ę�m��ͼteI1c��U�3RYZ�@ei1㔥�S�3J�75_FiQ�mH�\��*�G-W�=V��Up�K��{4r�c�T�-�(�c�å�qF�p-f��8\��`��4~O[��o�/D��,�P0�K��L��R��t�;m[ڣ�c=��>��3��S��Y", "��ں�p�X��P��l�ڮ6�u�}y4��&��pv^3�L�OW[�w��mW��>��bi��z)��f�~�ɞ\W^��N��m��f��j��O��1��w��.��β/�d��B�m�T=G�yK��N�;E�kĵ�N�N͞�=5�j��Ώ.� o2x��]��L>F#�_��n��=�AϮ��:�Ԥ��Ql�M&f�_d��k��g&�g�6�it?_��T'��y��w�'abޓϣ$}�t��!�H�i��7��ݤ�u1{�ʨ��-F��9��\��j]}��Gd��gg}E��a��rEӐ`�T��#m��9��` �-q0��M��UNO3��'��.r��WM�N��6]|�"+|�8.�z�F�zy�3D�B�Y�7��^[roL�sXS�y�:�� 5-'X!Ћe��ʠL�6x��p��jF��L��p+ܰe�@!%Y��r�3�m&hՅV�S�ŧ��"�S��bP��+K�~>��m��=*��k�Ƅ�KyX�䥄��FO_��y��E^FƗ�Ғ��TŚ��ܠ�E?��[��t��U]@u��\h:]Lj,�>�~Z�;�]u{��ߘ�rȂٓ�o Tb��)�-X��ɴyZ�S��#�Q��>��A]�n��>⠍� �a��5��?L�7�,+;>��afJQ��Gdڃ �JT0�:ў��O�y��~QϞ[l�*��&�Ej[�CM\��Y��w�Ėy+�cT��G�h.N�R��{�|�^!�5�Lb��<��C ~�׾�w��),^��2��A�ԥ:pjP��C��bfy��M�/X��%�Ѯ��F�}5_-�8��L{�sto�1�Ci6�|q;�N�Y7譨��2Sc��F��gBJ�o��;]�jk^�|=��{Ë��0�M�ד��o��7-�?�p*ʂ�P�L�C��ח��*��=�K��2��F ��J,��db&��|�,6B��;^@\h�h��5�7k��3m^�65tK��0fm�w��'F�z�AT>ۖ`�@`��^i��~66��xp�fp�搘�o��S��r?��`��lT�NV�K�b��PѲ��1�\��$i�"��", "�>�;�7�[Qcז��m��b��^�aK�mx��}�;`�9H�]��ߏ�I�΀�5��b��{��r��e��R��₲��-��ph��[7�ž4e�p�69N벳��)�|��]b1�j_��e��6q��O��鏛�I��Kkho�p��~�>>'�uǔz�o��$�kjS�~}��˹�±4[r�YI�p,��Y��{��n�(�~��%�m.�c2�z��?+J`��G�\��\�,�"�%�"�}��\|2�"�%�"�!�.!��t�l��i��#��Ox��q�'w�ǈ�Xz;Q��`%��"`%��i`%�!�`%��`%��|@�<2IQ��3�-~hpxY�q��!E�P�(k@�G�P�(k@AJh� ��E3k@��=k@��Gk@c�Q��}I�?��", "00000001�0000000100000001�00ca9n�8�W�b@2$��l��i��i�I3�}�͉j��Hr��%#��I��fiZ��s�+g��Y�X�f��:|V�%�>$��'|V��,0�.��i�+��G`u��vs�CW%�)�|X�*1MM�͇I��ԔAv 8��"��l�sehj�[d��1��|�s+�>Og[#��&�M,��X�6��kb��r��Հ��8��f�quGq��ܹ@q2��?��o��o�k<�w�(O�)oG�^ɐ�;�'�P�N��n��T�5,��^�A��nU��K�)�5(�_��n6�K��0��զ晀�@��;�$ɗҴ�̵��/Z�hf��g��a��|O�b��I��Z7�_9v��k��O�j�P�lW��[s��2šp�p>)zeO��q��(f>Ϲ2e֡��&��e<��8^rRp^��)zc1x@��m�p8t(�@,e�P۵u�9;~r8�'�@(c��$�H�,]�g��<�7EO"��@(��$Rm �H�m֎�BZ+֛-nѮ�d�R!�l!�%A��L�U�[�Ƥ��H 2�¡o�� )G/N��R�|��j�S��1z�(`< �T�&�@�R6?[�kL$��p0�@,e��o3p�Y��!�1(L��0��%��>0��ȕ��Le�", "6�1Hqp:�puaѰ�Y(��J�X�P��|��}�^��U8n��{�[Z�lk�H�p�{<�_�!��SÚHl��a�xd��^�.5��H9Ѷ��^J��x8f9\�8ڂy��P�)�A�� (2��&�n��{��r1F�'�(�bz�>�\��9{�G��pu��9��uN�B}��|6��u��=uI:��rg�}��ή��?@��1�b�l�;��E�K�(��(LF3WH��~��Ȓo݆d��kӟ"�Q�[T�@n�-hgs�D�A�#0Q��辚�_& '`fٛ�u{��O��A8,b��{b�[��r�Y�x�cT��De��iW�Z/�1�0dB&β<�w�O�<��!��a��b_)��>|y�\��!y݊�Y��G��.lۻ��ˈ9�TP��OJ�k�D�j"g5Y�x�ie�HV�O��V=ӳYLT�U�r��l2��'bPQ�ڙ<�Q�h��V.QU��s��'Ӑ�~�6"�w�7��L�b0�g/*�z��^�\�.JQ�j�%��1��LxV�ŐW�-�� (��v�!��!U��b��]��sG��Aq�t�E��jW�@�y��6�ʤ��,t�f"��*��;��Hw^DO��LL�ry)*�f(_ӭ�9u@)dͰė~��:E��a��o0W?9F�T�ZH�,8R>+��YK��|�@��v��Z�!�v�#��>o��~`ȻR�8S��n2�.��Y�޵bE��˳b��6?��IO]��B`8��^�g��閚$&�SQ-��A�4(�y��5r��\�!�r�I2�RQ��G�4�ff�⠀�d�-��$�lC��b4��=�p�Te[ҝ�T��M.}�]G��~��N8,)4�(��:�=B�Tp��b-��2�:�iC�iΦ�}u�o�hI��j�4��ٍ8=��5q=��l�he��i��"AA�<.!�.��S�^A,2��B�=ٝ�b:��H?��N��0=,��W��d��n��;=�c�І��t��ks��P��3B�N�r=0E�e�{��1K��aGUZ��\)d�i�05��H�DE��9e7ǂwa�ɢ&!)��", "~��X��J��g(��x��'�o��mW$ sF��QU2p�G��dTY6�rLߐ=a2�TZQNNҐ��δP��M��NvpQ��+�L��~�h�P�z��.��6$>�C��E�ȋj��=#R��6�IO4�AܠB�Y��W�M�TU�x��v��=6��E*Zq�Q$��3�D��f�W%I�fm2z�4�v��EUZK��_FqKě��û��#y��b�U)\t��!L�T-J��S�<�g�\� ��D�8܋�@v�Z�֠�tP?-A �~f�%�FZ��h5H��oG��ԩ�|�U��?�2��5��$�jX`�07�GQQ}U��aj�.�Z��m�/��O3GYn�4��a�H��'�[��^�3��o��^ޱ#z� ��az�Z55Q5�M��7��Q��F��(�<�c�I�~o tzc�7��1�4cYZpt:u~9=�u�r�3Ŭb�$��G4��Q�q3F��Pz�īKwb�s��`�'�IQc��0�I��O�s�4��\�C�!�6u�A��5}��f�)BcC��ԴfS�s�(n۟�b�kKp?|�T/��6�ޕȓ�DS�y�=d^��s��kJʱEm��Ghg��c#��a�|�]�ܐ��2ac�X��Ov��n��o�l�68�I,R�Mk\$:+�l��yX��bE�$�$�v1S�~��p�g+V&�Ku;��4��o9�R�Ő�N��5��F��)�??H9W�a�<ٮ�&G=U�3��h+Ҕ��{2��̵�d��6a�A"\��;��Hޫ�ӦN䉢��xE�G.h��*�Z�]��r|�zZu`�?��ے߬W�$��bڲ��U-]��IU�;�s��7k��_B��F��j��@(n� ��~��q�Ji�]�]�H7CT��D�Ƶe��/��m�A\Nؓ_��}֑!1��ͳ+�&��6�-��X%`��X�:��L��4%*��v|9YG�n�乽�cd�9�=��!�,�g_R��[��>e|-y��Y�-DHS�\��W��R��K~[({P:$Z�<&=M��岧\�\ȓ�ų�m�rĽ��hI�ʞ�<9�|z�Z�6��㾺�;��j��Q��O��", "/�|_;]��z��Q��O�㤠kM��i��j��r��B�y��C+�BgLSmY�E��9��zz�d}�k�j�c��(!3W��f t� ��n>�f��.�k�"��4sUk8W��i��ۆ��O�Ѻ��6�I�(��Wy��活��w��\̾V�ꘕv��u&e��_X��?$�0IW��5�gt�2F��jR��A��ܵ��Y�t,��s�6Y��W��vy�q��;�?�&��"�40�B!�u`�PŊ�SL�\8��*�Z�w��M{#cn5�Ȋ]Lwj:?�}O�і��?�S� 6�Gj�D]!��`�@[i@��PE��G�t�G�n�9��,ҍ*M'��a�:�6Xt'q0��d0d�Xl&��M�9=\zPc=u�9R��a#�!��xL�q#��+ލ��bϿ��b��xX��!}�>kd�!D��FFm��ɐ$>d��O�J��\��vg�4�9��٣R{4��)��ѧ7?��O��q��d]�V�nХ�Q�!9�I6�;1s/铛�d$�Lwe��g��e��\�4�ÈO�x��Ǫ(f90y(�ߠ�n,�a�ѐ��:��?�\��A��%tK��!��F��R��H�7�ף��l�{X�Bs��`,;�[*{�;�H%�+�#r�X<��ZV�-��I��d4J�q��PW��Xw�a�$�(�*��^Vc��S>�V�^�!Z��P�-��kw�.��Z��@xJJ��"M�Q\��涶��mPs;�& ��d3J�&�$��`�lx�hr�l�:�7ʖ�x|��L�l8�I��8)@�@$%�T2p�n�Ǩk6��\��9�?st5Y�c��Ω��(Ɠ��_� ʜ��n!hy�y��IǢ�E/s��i,٠��8��W�גn��2ڶ��ƣ�EH��%��p�q&�(�G�>X��o��t��+q�!��bO�r�S��Ľ�Gg��{�`(��w�W��dl��]�A��~��{�n��bb��C��^e�nй(�^�E=\ݚ�k!��(��Ӗvx�G/��.ix�0�+��", "00000001�0001d89�o��_�t5i�B�3�T��Vuk��k��Ґ�+��/o��y��{'m��?��NvL�9��)��Cl?;��v�[�Xa�w�ӂ��J��EG�"7�E!�+f�IPi��O�k�L-��D��!�� I�%�;/l�ñ�F�;��n&��ƛF#�~IwyJ`]��k�b��`�/"j8 Tw� Ɔ��~��$�_��*=�S�cAu�&�l��I0��O=D��9ט��K�RhM��^�fF��Q70�TF��Sy�MjZ�mX�M7|�SM��#��6�Ee;Ў�V�CY��9��Z$�α�1��k�6շ��t��Kb��Ƨ�$-ԲG�D]k��B[��^�z��-�U��2�v䢟��o�*Hե3��u��e�pغ�[�~��υq��Z��{l�?��i�m��7pv��j�MH��k[Q�JL]��Jn�E-�t��.��=ƺc�#N��t��K(��YA��V��72p��nG�o,�0��:�C�o��~��چ��v��:y��]φ�HW1��:�Xc^R�kY�o�Mq+�)�ڰ�ߠL8�b±}�G��z7�6��mU� V߹�΢�&�ˑ$�/{�vLt�MM��㒡c��nM��DE�|��SAlo�$Ӂ��AdS��ߚ�WK(i�$)�?�T�]U�� 6Q�%O2zue0ޭj��]��Oo15Ҕ��:�6�B1ŗ��^�iB~<��o`JD��Ra!f]uo�Q�� #E�6�6�t��;��1��z��G�U��m��iZWM��2=�om��=�0[/=�?�~x��k��zy�7�y�)��'��!��Ju�h:�N�sE�w��]!�{�.�T�X��f��|�֛�ә�|��3]:�~�-טG��o��=4�*T��>��I��s��N�(�8�5@KM�@�FdA�0�)D�tҚ�Dͤ ;ath��> ҬkYW&e��xB��:�XMBs�h`�D0$*��i;猛ϥ�`ߗB�<ط}��J�$(��rѺ.�V6.e^e��]?]�H��J��F-�Ё�4�p�X�x�6yꐅ3k�A�_=A|��wlI��-:&�+�''��\�"߉+8}/=�+=A�X��y��;є��<��3�#��^_�c��7h��$.�M�i��0�)R'��˦{��dׂ��E�m�h��5TQ��G5��{��Դ9��G5��S��VUY��Y�ܞ��~X�i��uy�o��@�;��Q�OẈ�Z�d�a��'�nඁ��w��qK.AG" Heuristic match: "bT_.Tp" Heuristic match: "LO.rU" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://www.facebook.com/legal/license/aJoeSHn7XcN/__d" Pattern match: "http://example.com" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crl9'E" Pattern match: "http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crlQ`6{ZMQ=r=3Xxq?kx]\9J" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "https://fonts.googleapis.com/css?family=YouTube+Sans:500" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "0BXZjrBt2Y5tUnm1u..BllsM7.Up.AAA.0.0.BllsM7.AWX0hco-5Y8facebook.com/9217340958809631098324340861597031080211O8OWZcxQ3qw61JD1ovoIxVFqfacebook.com/921765907494431160686340892797031080211_js_datrO8OWZT7V9-jFrvMBlhmxhVK-facebook.com/108952881331231160678367072" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921789960934431083036368890802631080211VISITOR_INFO1_LIVEgl0_jycmAbMyoutube.com/9217305669401631116429369800002831080211VISITOR_PRIVACY_METADATACgJVUxIE" Pattern match: "https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff" Pattern match: "https://fonts.google.com/license/googlerestricted@font-face" Pattern match: "0BXZjrBt2Y5tUnm1u..BllsM7.Up.AAA.0.0.BllsNR.AWXjL9WtLacfacebook.com/9217362958809631098324314722033031080212O8OWZcxQ3qw61JD1ovoIxVFqfacebook.com/921765907494431160686340892797031080211datrO8OWZT7V9-jFrvMBlhmxhVK-facebook.com/9217879074944311606863147064330" Pattern match: "0BXZjrBt2Y5tUnm1u..BllsM7.Up.AAA.0.0.BllsM7.AWX0hco-5Y8facebook.com/9217340958809631098324340861597031080211O8OWZcxQ3qw61JD1ovoIxVFqfacebook.com/921765907494431160686340892797031080211datrO8OWZT7V9-jFrvMBlhmxhVK-facebook.com/9217879074944311606863147064330" Pattern match: "MUIDB2443B82ED8046A773994ABD2D9486B2Cwww.msn.com/9216261327449631158674274167031431080224sptmarketen-us||us|en-us|en-us|en||RefA=E867D3BCCD2A4182826C46FFCA3871E2.RefC=2024-01-04T14:40:43Zwww.msn.com/102444670348831227272374232232031080224" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921789960934431083036368890802631080211VISITOR_INFO1_LIVEgl0_jycmAbMyoutube.com/9217305669401631116429369800002831080211" Pattern match: "AJjNybmN-fOJBxauaccounts.google.com/92174280097280312270702438778170310802537367867_52_52_123900_48_436380accounts.google.com/1089202962188831086247216571521331080212" Pattern match: "K7A7wzCPkq2dxShUaccounts.google.com/92173680097280312270701975538916310802127367867_52_52_123900_48_436380accounts.google.com/1089202962188831086247216571521331080212" Pattern match: "xQ0DfdDHz0lcrXzCaccounts.google.com/9217775129984312270713198711852310803407367867_52_52_123900_48_436380accounts.google.com/1089202962188831086247216571521331080212" Pattern match: "M9rPo3qsCxMPDi5paccounts.google.com/9217675129984312270711146780218310803307367867_52_52_123900_48_436380accounts.google.com/1089202962188831086247216571521331080212" Pattern match: "GLwdORqVIFIfMPuqaccounts.google.com/921785129984312270714091696915310802637367867_52_52_123900_48_436380accounts.google.com/1089202962188831086247216571521331080212" Pattern match: "9216261327449631158674374045031631080224MUID2443B82ED8046A773994ABD2D9486B2Cmsn.com/1025261327449631158674274104631331080224USRLOCmsn.com/921744670348831227272374247832031080224" Pattern match: "0BXZjrBt2Y5tUnm1u..BllsM7.Up.AAA.0.0.BllsM7.AWX0hco-5Y8facebook.com/9217340958809631098324340861597031080211O8OWZcxQ3qw61JD1ovoIxVFqfacebook.com/921765907494431160686340892797031080211" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921789960934431083036368890802631080211" Pattern match: "9216261327449631158674374045031631080224MUID2443B82ED8046A773994ABD2D9486B2Cmsn.com/1025261327449631158674274104631331080224" Pattern match: "9bfez4EVCd0mGUsRaccounts.google.com/9217358009728031227070368890802631080211" Pattern match: ".google.com/9217357009728031227070361632801131080211" Pattern match: "K7A7wzCPkq2dxShUaccounts.google.com/9217368009728031227070197553891631080212" Pattern match: "0BXZjrBt2Y5tUnm1u..BllsM7.Up.AAA.0.0.BllsM7.AWX0hco-5Y8facebook.com/9217340958809631098324340861597031080211" Pattern match: "MUIDB3BB85B04C08D6D64350F48F8C1096CAEieonline.microsoft.com/9216258327449631158674362293313631080221" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088275725324831080212216521520531080212" Pattern match: "MUIDB2443B82ED8046A773994ABD2D9486B2Cwww.msn.com/9216261327449631158674274167031431080224" Pattern match: "MUID2443B82ED8046A773994ABD2D9486B2Cmsn.com/1025261327449631158674274104631331080224" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "accounts.youtube.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2G_vYbIR2X93X7V-pCAe9iMnDZucA87L1SNsBVfZgOKn0I-qZIvRzm8cmoi4PIuZOIoQLvcQStrict-Transport-Security" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2G_vYbIR2X93X7V-pCAe9iMnDZucA87L1SNsBVfZgOKn0I-qZIvRzm8cmoi4PIuZOIoQLvcQ" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Content-Encoding" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Accept-CH" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-cLK4Lw&theme=glif" Pattern match: "https://accounts.google.com/ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=ASKXGp2HvXCfaw_vyTLD1Vpizpwg1Dhljl5e9E1ci8ASm-CX2kTTuX-6cX3RadSkBwqBfNI-cLK4Lw&theme" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Permissions-Policy" Pattern match: "https://accounts.google.com/ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH28P-Be3s" Pattern match: "https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH28P-Be3sOATYlw&theme=glif" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3thYj5fNfK3z4V6drDirELniAcbRuQlT5M7te4u_GjMj-Fjtr3IbnXSnI0" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=ASKXGp2hxbLzjr--Gsg5DFntBciSY8GSF_RZhEx432Fqsg7E9_NHFRpjkWX5iKAH28P-Be3sOATYlw&theme" Pattern match: "https://www.facebook.com/loginStrict-Transport-Security" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=100Accept-Language" Pattern match: "www.youtube.comDNT" Pattern match: "www.youtube.comCookie" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube_main}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}Content-Length" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "rsrc.php/v3/yF/l/0,cross/0c3LcPcNMEz.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yH/l/0,cross/A3tiDdwKtg5.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yO/l/0,cross/EVmD_liOmwc.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y5/l/0,cross/L3lExXePTzJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/y1/r/4lCu2zih0ca.svg" Pattern match: "rsrc.php/v3/yd/r/qczqs7QMr3-.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3i7M54/yw/l/en_US/Br6EHF-GHmg.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/yk/r/RKK6hMCj3R1.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yx/r/GIlJjyzEguQ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yG/r/CbM6CZG2ZAb.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yv/r/HtdXy-2D6mm.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yb/r/Atn6-5S2M-o.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yE/r/_BJqgRg0BU5.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/aBIoq18cchP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/Jn0xcQmjzFV.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yo/r/LDFDUeRDitE.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3ihVQ4/y8/l/en_US/Ch_YChJCKQS.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/ysfm_2i9xtW.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "rsrc.php/v3/y2/r/O287_AcFyg4.png" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-5638156492532584744\,3,[null,\S-1543359670:1704379197917920\]],null,null,null,null,null,null,-3600,null,null,null,null,null,1],[1704376004000,null,null,null,null,null,null,[[[307,64002,nu" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "http://play.google.comCross-Origin-Resource-Policy" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.2JArRS0rdKQ.L.B1.O/am=P4GFpBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlEYz_rdA8RQMr7Njgwnd7huKhvzIQ/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GGqU-YUcxZ8.es5.O/am=P4GFpBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEwd-mUysR3osk3HKCDEBvz917yvQ/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Heuristic match: "use strict;_F_installCss(.Mh0NNb{background-color:#323232;bottom:0;box-sizing:border-box;box-shadow:0px 6px 10px 0px rgba(0,0,0,.14),0px 1px 18px 0px rgba(0,0,0,.12),0px 3px 5px -1px rgba(0,0,0,.2);color:#fff;display:-ms-flexbox;display:-ms-flexbox;disp" Pattern match: "com.google.android.gms/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver,com.google.android.gms.supervision/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver" Pattern match: "https://www.google.com/log?format=json&hasfast=true:https://play.google.com/log?format=json&hasfast=true" Pattern match: "https://play.google.com/log?format=json&hasfast=true;this.Na=!0;this.Ma=!1;this.Kg=;this.oa=this.aa=this.da=!1;this.network=new" Pattern match: "https://policies.google.com/terms+(f?/embedded:)+?hl=+_.Wy(d)+&gl=+_.Wy(c)+" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.Wy(d)+&gl=+_.Wy(c)+(g?&color_scheme=+_.Wy(g):)+((null==e?0:e.x$)?#infocollect:);break;case" Pattern match: "https://play.google.com/intl/+_.Wy(l)+/about/play-terms/embedded/+(g??color_scheme=+_.Wy(g):);break;case" Pattern match: "https://www.youtube.com/t/terms?chromeless=1&hl=+_.Wy(l);break;case" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.Wy(d)+&gl=+_.Wy(c)+(g?&color_scheme=+_.Wy(g):)+#inforetaining;break;case" Pattern match: "https://policies.google.com/privacy/additional+(f?/embedded:)+?hl=+_.Wy(d)+&gl=jp+(g?&color_scheme=+_.Wy(g):);break;case" Pattern match: "http://+this.ea.substring(this.Ca.length)" Pattern match: "http://www.w3.org/XML/1998/namespace:0===b.lastIndexOf(xlink:,0)?http://www.w3.org/1999/xlink:null" Pattern match: "http://www.w3.org/2000/svg:math===a?http://www.w3.org/1998/Math/MathML:null==d||foreignObject===XA(d).da?null:d.namespaceURI" Pattern match: "https://www.w3.org/2000/svg'+" Pattern match: "https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg" Pattern match: "https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_48dp.png" Pattern match: "https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png" Pattern match: "https://ssl.gstatic.com/accounts/animation/+_.Xy" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_device.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_pin.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/usb_key.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_phone.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/paaskey.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkeyerror.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_success.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_keys.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-password.svg" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif" Pattern match: "https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif" Pattern match: "https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_1.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_1.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_1.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/get_family_link_1.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_1.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_1.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_1.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/screenlock.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif" Pattern match: "https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kid_success.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/red_globe_light.svg" Pattern match: "https://ssl.gstatic.com/apps/signup/resources/custom-email-address.svg" Pattern match: "https://www.w3.org/2000/svg" Pattern match: "https://accounts.google.com/TOS?loc=+_.Wy(a.XW)+&hl=+_.Wy(b)+&privacy=true" Pattern match: "https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072" Pattern match: "https://g.co/recover" Pattern match: "https://play.google.com/work/enroll?identifier=+_.Di(a)" Pattern match: "a.rb/1E3/c,this.da=-1==this.da?a:.3*a+.7*this.da" Pattern match: "https://play.google.com/log?format=json&hasfast=true;this.Na=!0;this.Ma=!1;this.Jg=;this.oa=this.aa=this.da=!1;this.network=new" Pattern match: "https://policies.google.com/terms+(f?/embedded:)+?hl=+_.ty(d)+&gl=+_.ty(c)+" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.ty(d)+&gl=+_.ty(c)+(g?&color_scheme=+_.ty(g):)+((null==e?0:e.B$)?#infocollect:);break;case" Pattern match: "https://policies.google.com/privacy/additional/embedded?gl=kr+(g?&color_scheme=+_.ty(g):);break;case" Pattern match: "https://www.youtube.com/t/terms?chromeless=1&hl=+_.ty(l);break;case" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.ty(d)+&gl=+_.ty(c)+(g?&color_scheme=+_.ty(g):)+#inforetaining;break;case" Pattern match: "https://policies.google.com/privacy/additional+(f?/embedded:)+?hl=+_.ty(d)+&gl=jp+(g?&color_scheme=+_.ty(g):);break;case" Pattern match: "http://www.w3.org/2000/svg:math===a?http://www.w3.org/1998/Math/MathML:null==d||foreignObject===uA(d).da?null:d.namespaceURI" Pattern match: "https://ssl.gstatic.com/accounts/animation/+_.uy" Pattern match: "https://accounts.google.com/TOS?loc=+_.ty(a.dX)+&hl=+_.ty(b)+&privacy=true" Pattern match: "https://play.google.com/work/enroll?identifier=+_.zi(a)" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.22-VWxzprc0.L.I11.O/am=P4GFpBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlGH2ZjR01FsHr4lBcI3_x3ZoEMTvg/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/f4449159/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/f4449159/cssbin/www-main-desktop-watch-page-skeleton.css" Heuristic match: "%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\Get-MpPreference.COM" Heuristic match: "%WINDIR%\system32\Get-MpPreference.COM" Heuristic match: "%WINDIR%\Get-MpPreference.COM" Heuristic match: "%WINDIR%\System32\Wbem\Get-MpPreference.COM" Heuristic match: "%WINDIR%\System32\WindowsPowerShell\v1.0\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Scripts\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\Get-MpPreference.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Get-MpPreference.COM" Pattern match: "www.sysinternals.com" Pattern match: "https://api.ip.s" Heuristic match: "IndexedDB\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.in" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "IXP004.TMP/2pX3090.exe" Pattern match: "IXP004.TMP/2pX3090.exe.config" Heuristic match: ".BT" Pattern match: "www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F" Heuristic match: ">h.MR" Heuristic match: "c &.WF" Pattern match: "https://enigmaprotector.com/" Heuristic match: "E-mail : support@enigmaprotector.com" Heuristic match: "vbnp.ax" Heuristic match: "wmimgmt.ms" Pattern match: "https://ipinfo.io/widget/demo/67.218.111.202"5c:T2b7b,Found URL "https://t.me/riseprosupport" - Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00000720.00000001.68377.03510000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00000720.00000001.68377.03510000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00000720.00000001.68377.03510000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000720.00000001.68377.03510000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000720.00000001.68377.03510000.00000004.mdmp") Found URL "https://enigmaprotector.com/e-mail" - Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found URL "https://t.me/riseprosupportdefault1.1.1.1invariant" - Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found URL "http://timevaluesers\hapubw:data\local\6ams\python\2n36-32\pat..com;.exe;.*cmd;.vbs;.v&s;.jse;.wsf" - Source: "00000000-00002408.00000001.67954.00090000.00000004.mdmp") Found URL "http://enigmaprotector.com/varfileinfotranslation\win:\windows\system32\nsi.dllstem32:\windows\temp\vxssl32.dllf78b956-909d-45b2-8b8d-2e5e1d522649:\windows\system32\api-ms-win-core-synch-l1-2-0.dllviewtooltipclassata\local\temp:\windows\temp\vxole32.dllranslationmsiscanbufferws\zpecbdvapi32inishmsgxtractoptindows\systwindowspowel\v1.0\;c:\\hapubws\ap\local\progpython\pyth32\scripts\sers\hapubwdata\local\ams\python\n38-32\;c:\\hapubws\ap\local\progpython\pyth32\scripts\>sers\hapubw:data\local\6ams\python\2n36-32\pat..com;.exe;.*cmd;.vbs;.v&s;.jse;.wsf" - Source: "00000000-00002408.00000002.68679.00090000.00000004.mdmp") Found URL "https://www.youtube.com/chxreadingstringime.dllsenumerateprocessesexwionwdevicepairingfolder.dlldevicepairinghandler.dll\windows\system32\ieframe.dll\windows\system32\ieframe.dll\windows\system32\shell32.dllttps://accounts.google.com/locationnotifications.exettps://accounts.google.com/mediametadatahandler.dllmsvcp140_atomic_wait.dllhttps://www.youtube.com/\mixelevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll127p52c64b7eistview32stem32\imm32.dllh;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-:\windows\system32\winspool.drvpdata\lo_:\windows\system32\setupapi.dllmp\_:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllindows\system32\ext-ms-win-kernel32-package-current-l1-1-0.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dlldata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00002416.00000000.66092.00560000.00000004.mdmp") Found URL "https://facebook.com/loginwindowsanytimeupgradeui.exeware\microsoft\oleautindowsindows:\windows\inf:\windows\infindowsfficient" - Source: "00000000-00002416.00000000.66092.00560000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllhttps://www.youtube.com/api-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/https://www.youtube.com/api-ms-win-security-sddl-l1-1-0.dllapi-ms-win-service-core-l1-1-0.dllapi-ms-win-service-winsvc-l1-1-0.dllauxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00002416.00000000.66092.00560000.00000004.mdmp") Found URL "https://www.youtube.com/i" - Source: "00000000-00002416.00000000.66100.005B6000.00000004.mdmp")5d:T89d,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Thu, 04 Jan 2024 14:40:11 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Thu, 04 Jan 2024 14:41:21 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Connection: Keep-AliveHost: www.facebook.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Wed, 03 Jan 2024 03:24:20 GMTExpires: Thu, 02 Jan 2025 03:24:20 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 126943Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")5e:Tbe9,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBZwXm7t3kKEEFjsmHQeLcQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvz" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpYRvzN3kAuEMlMWsqSFLc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"5f:T668,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1241581683" "cx": "490" "cy": "30"} "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "654377845" "cx": "16" "cy": "16"} "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2013333299" "cx": "490" "cy": "30"} "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1241581683" "cx": "88" "cy": "26"} "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2013333299" "cx": "88" "cy": "26"} "1dP82wv5.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "503385101" "cx": "32" "cy": "32"} "1dP82wv5.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "503385101" "cx": "16" "cy": "16"} "4Wo403IN.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1493239936" "cx": "1" "cy": "1"} "4Wo403IN.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "4278259175" "cx": "1" "cy": "1"} "RegAsm.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "369167240" "cx": "154" "cy": "30"} "RegAsm.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1392577570" "cx": "16" "cy": "16"} "RegAsm.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1392577570" "cx": "154" "cy": "30"} "RegAsm.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2264990330" "cx": "1" "cy": "1"} "RegAsm.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2030112322" "cx": "1" "cy": "1"}60:T63b,"2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindNextFileW" with parameter 6kG0qp7.exe (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindNextFileW" with parameter Xj6Hl21.exe (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00003932) "2f3c9be60064deb5a63a27f1c4e50cc0.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003932) "Xj6Hl21.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindNextFileW" with parameter 5kB6gI2.exe (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindNextFileW" with parameter SP4Rr42.exe (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003284) "Xj6Hl21.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003284) "SP4Rr42.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00002420) "SP4Rr42.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002420) "SP4Rr42.exe" called "FindNextFileW" with parameter 4Wo403IN.exe (UID: 00000000-00002420) "SP4Rr42.exe" called "FindNextFileW" with parameter Qf8gp08.exe (UID: 00000000-00002420)61:Te9d,file/memory contains long string with (Indicator: ".decrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "base64"; File: "SSL") Found string "AesFastEngine" (Indicator: "aes"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "AesGcm256" (Indicator: "aes"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "AesManaged" (Indicator: "aes"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "ToBase64String" (Indicator: "base64"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found string "AEs54GSHjhaedjaNtHK" (Indicator: "aes"; File: "00000000-00003436.00000000.70327.01352000.00000020.mdmp") file/memory contains long string with (Indicator: "base64"; File: "HQECIU84.js") file/memory contains long string with (Indicator: "aes"; File: "HQECIU84.js") file/memory contains long string with (Indicator: "base64"; File: "K1UB32KQ.js") file/memory contains long string with (Indicator: "aes"; File: "K1UB32KQ.js") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm")62:T67c,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp")63:Tbfa,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000720.00000002.68664.00411000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.6057D000.00000002.mdmp, 00000000-00000720.00000002.68664.60593000.00000002.mdmp")64:T453,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "2f3c9be60064deb5a63a27f1c4e50cc0.exe") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00000720.00000001.68377.000A2000.00000040.mdmp")65:Tf07,file/memory contains long string with (Indicator: "password"; File: "~DF714101D1ECBA440F.TMP") file/memory contains long string with (Indicator: "password"; File: "_DBF4DD47-AB06-11EE-9046-00505691C0FA_.dat") file/memory contains long string with (Indicator: "password"; File: "SSL") Found string "password" (Indicator: "password"; File: "00000000-00001300.00000000.69405.00DA3000.00000040.mdmp") file/memory contains long string with (Indicator: "password"; File: "HQECIU84.js") file/memory contains long string with (Indicator: "password"; File: "K1UB32KQ.js") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "passwords.txt" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.059D0000.00000002.mdmp") Found string "catch save passwords$" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "SELECT action_url, origin_url, username_value, password_value FROM logins" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "catch passwords sql" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "mark_check_passwords" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "catch quantum passwords sql" (Indicator: "password"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp")66:T646,Found string "SELECT * FROM Win32_Process Wher" (Indicator: " Win32_Process"; Source: "00000000-00001300-00000C94-94825037") Found string "AntivirusProduct|AntiSpyWareProduct|FirewallProd" (Indicator: "antivirusproduct"; Source: "00000000-00001300-00000C94-94859724") Found string "SELECT * FROM Win32_LogicalDisk WHERE DeviceID = '" (Indicator: " Win32_LogicalDisk"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "SELECT * FROM Win32_PhysicalMemory" (Indicator: " Win32_PhysicalMemory"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp")67:T7eb,Found string "\Device\LanmanRe" (Indicator: "\Device\"; Source: "00000000-00001300-00000C94-94971501") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000720.00000000.66456.00930000.00000004.mdmp, 00000000-00000720.00000001.68377.00930000.00000004.mdmp, 00000000-00000720.00000002.68664.00930000.00000004.mdmp")68:T1038,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableBehaviorMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableBlockAtFirstSeen $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableIOAVProtection $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableIntrusionPreventionSystem $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -SubmitSamplesConsent 2" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -MAPSReporting 0" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp")69:T11b2,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 2f3c9be60064deb5a63a27f1c4e50cc0.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Qf8gp08.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Qf8gp08.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Qf8gp08.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Qf8gp08.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Qf8gp08.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Vr8oH09.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Vr8oH09.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Vr8oH09.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Vr8oH09.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Vr8oH09.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1dP82wv5.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 1dP82wv5.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 1dP82wv5.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 1dP82wv5.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 1dP82wv5.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 1dP82wv5.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1dP82wv5.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1dP82wv5.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 1dP82wv5.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 1dP82wv5.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1dP82wv5.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1dP82wv5.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 1dP82wv5.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1dP82wv5.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 1dP82wv5.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1dP82wv5.exe]6a:T9ac,"2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "2pX3090.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")6b:T1038,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableBehaviorMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableBlockAtFirstSeen $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableIOAVProtection $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableIntrusionPreventionSystem $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -SubmitSamplesConsent 2" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -MAPSReporting 0" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00000720.00000000.66456.03510000.00000004.mdmp, 00000000-00000720.00000001.68377.03510000.00000004.mdmp, 00000000-00000720.00000002.68664.03510000.00000004.mdmp")6c:T752,"Xj6Hl21.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Xj6Hl21.exe]- [targetUID: 00000000-00003932] "SP4Rr42.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\SP4Rr42.exe]- [targetUID: 00000000-00003284] "4Wo403IN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4Wo403IN.exe]- [targetUID: 00000000-00001300] "6kG0qp7.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- Location: [%TEMP%\IXP000.TMP\6kG0qp7.exe]- [targetUID: 00000000-00003932] "Qf8gp08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Qf8gp08.exe]- [targetUID: 00000000-00002404] "Vr8oH09.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Vr8oH09.exe]- [targetUID: 00000000-00002404] "2pX3090.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2pX3090.exe]- [targetUID: 00000000-00000720] "1dP82wv5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1dP82wv5.exe]- [targetUID: 00000000-00002408] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\tempAVS4CE6aJWI15Cd\sqlite3.dll]- [targetUID: 00000000-00000720] "5kB6gI2.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP001.TMP\5kB6gI2.exe]- [targetUID: 00000000-00003436] "3hL78Uj.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3hL78Uj.exe]- [targetUID: 00000000-00002404] "FANBooster131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00000720]6d:T133d,Dropped file: "qemu-ga.exe" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe]- [targetUID: 00000000-00001704] Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00000720] Dropped file: "K1UB32KQ.js" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\K1UB32KQ.js]- [targetUID: 00000000-00003232] Dropped file: "HQECIU84.js" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\HQECIU84.js]- [targetUID: 00000000-00003232] Dropped file: "V0MSDWKU.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\V0MSDWKU.htm]- [targetUID: 00000000-00000280] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00000280] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00000280] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003232] Dropped file: "C88418EDBE65AF3960916D9E8011370D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C88418EDBE65AF3960916D9E8011370D]- [targetUID: 00000000-00003232] Dropped file: "QCI109FM1B56WI60S0PS.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\QCI109FM1B56WI60S0PS.temp]- [targetUID: 00000000-00002716] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00000280] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00003232] Dropped file: "0AB67BD4882FB0E09822529CFEB33A58" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0AB67BD4882FB0E09822529CFEB33A58]- [targetUID: 00000000-00000280] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003232] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003232] Dropped file: "MF7C6RNT.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\MF7C6RNT.txt]- [targetUID: 00000000-00000280] Dropped file: "E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96]- [targetUID: 00000000-00003232] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00000280] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_5EB1CBA003F9559FC0FD2BE8FBD6D2B1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_5EB1CBA003F9559FC0FD2BE8FBD6D2B1]- [targetUID: 00000000-00002728] Dropped file: "F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_EC50BC49A28D68A36F5274F1BD1417C1]- [targetUID: 00000000-00003232] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06]- [targetUID: 00000000-00003232] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00000280] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_CEAEC54FF3AD732862C0691CA17A76C5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_CEAEC54FF3AD732862C0691CA17A76C5]- [targetUID: 00000000-00002728] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002728] Dropped file: "X9V7UQSH.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\X9V7UQSH.txt]- [targetUID: 00000000-00000280]6e:T414,"dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png" "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1" and extension "gif"6f:T8004,"initAft()