24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 83:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T465,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 93a5e769b10b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 93a5e769b10b…. Malware family: Malware. Threat score 100/100. 11/25 AV engines flagged this file. 24 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/93a5e769b10b1c80fec8042956d84562012e8d3c0d1a3e2970dd7361f79d33df","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","93a5e769b10b1c80fec8042956d84562012e8d3c0d1a3e2970dd7361f79d33df"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"93a5e769b10b1c80fec8042956d84562012e8d3c0d1a3e2970dd7361f79d33df","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":24,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T997,"file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646544'}" (UID: 00000000-00003004) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646576'}" (UID: 00000000-00003004) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646560'}" (UID: 00000000-00003004) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646528'}" (UID: 00000000-00003004) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646480'}" (UID: 00000000-00003004) "HA3aE65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156176'}" (UID: 00000000-00003904) "HA3aE65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156208'}" (UID: 00000000-00003904) "HA3aE65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156192'}" (UID: 00000000-00003904) "HA3aE65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156160'}" (UID: 00000000-00003904) "HA3aE65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156112'}" (UID: 00000000-00003904) "Xx5lZ48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1886288'}" (UID: 00000000-00001388) "Xx5lZ48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1886320'}" (UID: 00000000-00001388) "Xx5lZ48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1886304'}" (UID: 00000000-00001388) "Xx5lZ48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1886272'}" (UID: 00000000-00001388) "Xx5lZ48.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1886224'}" (UID: 00000000-00001388) "AC6JZ27.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372048'}" (UID: 00000000-00000176) "AC6JZ27.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372080'}" (UID: 00000000-00000176) "AC6JZ27.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372064'}" (UID: 00000000-00000176) "AC6JZ27.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12372032'}" (UID: 00000000-00000176) "AC6JZ27.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12371984'}" (UID: 00000000-00000176) "Sr7kI69.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8570960'}" (UID: 00000000-00001828)26:T463,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1pq69xq8.exe.3231849778") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1pq69xq8.exe.3231849778") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp")27:T74f,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp")28:T6d9,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2dI7778.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2dI7778.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "_tJ17sGyxOX_1_.js") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00000628.00000001.66648.00371000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00000628.00000001.66648.00371000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp")29:T7b6,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003004-3212-10-012B6CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003004-3212-7-012B6F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001388-7387-10-001C6CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001388-7387-7-001C6F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001828-11146-10-00826CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001828-11146-7-00826F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002008-13488-808-004123F1 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002008-13488-43-0040E61C SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002008-13488-16-0040CE09 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002008-13488-393-00416F6A SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000628-16391-120-003715B5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000628-16391-1828-00371748 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000628-16391-70-00377653 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000628-16391-46-00371A43 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001308-19689-49-00D56C62 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001308-19689-47-00D55DFD SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001932-26285-35-0002499C SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001932-26285-34-00028738 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002868-10044-127-00409950 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002868-10044-128-00409930 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003124-17771-34-00058738 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003124-17771-35-0005499C SetUnhandledExceptionFilter@KERNEL32.dll at 19985-1042-004123F1 SetUnhandledExceptionFilter@KERNEL32.dll at 19985-544-00416F6A SetUnhandledExceptionFilter@KERNEL32.dll at 30812-1945-004017482a:T13e9,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003004-3212-31-012B2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003004-3212-31-012B2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-29-012B52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-29-012B52B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-63-012B5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-63-012B5467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-60-012B597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-60-012B597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-52-012B4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-52-012B4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-74-012B36EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-74-012B36EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-37-012B3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-37-012B3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-33-012B2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-33-012B2F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-66-012B2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-66-012B2630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-40-012B2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-40-012B2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-59-012B621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-59-012B621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-78-012B5C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-78-012B5C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-44-012B2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-44-012B2AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-43-012B1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-43-012B1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-71-012B2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-71-012B2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-77-012B2773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-77-012B2773 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00003004-3212-83-012B7155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00003004-3212-83-012B7155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00003004-3212-83-012B7155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003004-3212-83-012B7155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00003004-3212-83-012B7155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-15-012B1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-15-012B1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-22-012B681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-22-012B681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-65-012B53A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-65-012B53A1 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003004-3212-36-012B3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003004-3212-36-012B3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-57-012B6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-57-012B6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-16-012B44B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-16-012B44B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-62-012B55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-62-012B55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003004-3212-26-012B24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003004-3212-26-012B24E02b:Te57,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ugOnzZiqGRLOtxtjC60RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 97Cache-Control: no-cache"2c:T49f,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Hooks key cryptographic functions of the CryptoAPI Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: PCAP contains base64 strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to decode base64 data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2d:T13b6,"file.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003004) "HA3aE65.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003904) "Xx5lZ48.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001388) "AC6JZ27.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000176) "Sr7kI69.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001828) "1pq69xq8.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002008) "1pq69xq8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002008) "1pq69xq8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000030000000000080013000000000006a00000000000000500130007e000000b0193600000000007e0000001800010114000000d327f86c40f3120095e1d57765313700000000000200000200253500ee0000eeb0193600010000000000000080000000a8193600c73600f1f8fa35000100000000000000020000000c00000040cb350040cb35003bcb350000000000ecf2120000003000b019360130f21200f8f2120050f8120095e1d57745313700feffffff435cd9775059d97794000000a00000003acb350038cb350094000000d4f31200fdfe7976d80800007cf3120080f31200 (UID: 00000000-00002008)2e:T205f,"1pq69xq8.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006ccb350000000000000074002e004e00450054005c004600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000033003200 (UID: 00000000-00002008) "2dI7778.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000628) "2dI7778.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000628) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000bcea32008a87b075f8715c006ceb3200980a1502980a1502000000002c30b075b2f4d9772762c37754eb320000003e7200003e72bcea3200e4ea3200f0000000f0003e7200000000c0ea32000000000054ec3200000000000100000024eb320040f5d977000000000000000010eb3200 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000058ec32006a6fea6400000000bc6fea647c09830ed4e732000000000040f1320015de4b763827fc78feffffff7f675376e2d82f762824206e02000000000000001800000030a5b86b18ec320028231b6c00005800000000000c00000030a5b86b24ec32002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000004eb32006a6fea6400000000bc6fea640808830e80e632000000000040f1320015de4b763827fc78feffffff7f675376e2d82f762824206e02000000000000001800000030a5b86bc4ea320028231b6c00005800000000000c00000030a5b86bd0ea32002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006b384a670000000000b8ef50089823e36b384a670004f05008e722e26b384a670020000000000000003c37e26b281238022022540228123802202254020200000000000000180000007586453908f0500828231b6c00005800000000000c0000002022540214f050082f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007680c70207981803070000000080c702071000000000000000d8e9320050dc8b7780c70207100000006c7b03078c94d1071000000004ea3200a6ec9f6e02000000000000001800000028c79f6e08ea320028231b6c00005800000000000c00000028c79f6e14ea32002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007680c70207981803070000000080c702071000000000000000dce9320050dc8b7780c70207100000003c72ff067c96d1071000000008ea3200a6ec9f6e02000000000000001800000028c79f6e0cea320028231b6c00005800000000000c00000028c79f6e18ea32002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006be04c67000000000028f1fe079823e36be04c670074f1fe07e722e26be04c670020000000000000003c37e26b281238022082540228123802208254020200000000000000180000007586453978f1fe0728231b6c00005800000000000c0000002082540284f1fe072f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007680c70207981803070000000080c702071000000000000000dce9320050dc8b7780c70207100000006c7b03078498d1071000000008ea3200a6ec9f6e02000000000000001800000028c79f6e0cea320028231b6c00005800000000000c00000028c79f6e18ea32002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006bf826010700000000e8ee05089823e36bf826010734ef0508e722e26bf826010720000000000000003c37e26b2812380220e254022812380220e254020200000000000000180000007586453938ef050828231b6c00005800000000000c00000020e2540244ef05082f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007680c70207981803070000000080c702071000000000000000dce9320050dc8b7780c7020710000000244705072441d1071000000008ea3200a6ec9f6e02000000000000001800000028c79f6e0cea320028231b6c00005800000000000c00000028c79f6e18ea32002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a386e36bd82801070000000070f24c089823e36bd8280107b8f24c08e722e26bd828010720000000000000003c37e26b28123802204255022812380202000000000000001800000000280107bcf24c0828231b6c00005800000000000c00000020425502c8f24c082f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a386e36b602d01070000000070f257089823e36b602d0107b8f25708e722e26b602d010720000000000000003c37e26b281238022022570228123802020000000000000018000000002d0107bcf2570828231b6c00005800000000000c00000020225702c8f257082f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007680c70207981803070000000080c702071000000000000000b0e6320050dc8b7780c7020710000000147c03072441d10710000000dce63200a6ec9f6e02000000000000001800000028c79f6ee0e6320028231b6c00005800000000000c00000028c79f6eece632002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000fce732006a6fea6400000000bc6fea641005830e78e332000000000040f1320015de4b763827fc78feffffff7f675376e2d82f762824206e02000000000000001800000030a5b86bbce7320028231b6c00005800000000000c00000030a5b86bc8e732002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a386e36b883701070000000040ee4c089823e36b8837010788ee4c08e722e26b8837010720000000000000003c37e26b281238022082580228123802020000000000000018000000003701078cee4c0828231b6c00005800000000000c0000002082580298ee4c082f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007680c70207981803070000000080c7020710000000000000001cea320050dc8b7780c7020710000000244705072441d1071000000048ea3200a6ec9f6e02000000000000001800000028c79f6e4cea320028231b6c00005800000000000c00000028c79f6e58ea32002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000044eb32006a6fea6400000000bc6fea644808830ec0e632000000000040f1320015de4b763827fc78feffffff7f675376e2d82f762824206e02000000000000001800000030a5b86b04eb320028231b6c00005800000000000c00000030a5b86b10eb32002f99b86b0c000000 (UID: 00000000-00002088) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310008a386e36be84001070000000020ed55089823e36be840010768ed5508e722e26be840010720000000000000003c37e26b2812380220e2580228123802020000000000000018000000004001076ced550828231b6c00005800000000000c00000020e2580278ed55082f99b86b0c000000 (UID: 00000000-00002088)2f:T7a7,"file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "HA3aE65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "HA3aE65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Xx5lZ48.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Xx5lZ48.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AC6JZ27.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "AC6JZ27.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Sr7kI69.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Sr7kI69.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1pq69xq8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2dI7778.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Zf97dE.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Zf97dE.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4id504yr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4id504yr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")30:T468,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "file") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "file") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp")31:T48d,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp")32:Te78,"2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2dI7778.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")33:T7e6,"2dI7778.exe" queries volume information of "C:\" at 00000000-00000628-0000010C-165617 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00002088-0000010C-606815 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002088-0000010C-2797201 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002088-0000010C-2807856 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002088-0000010C-4145801 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002088-0000010C-4151830 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002088-0000010C-4794869 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\fefffe8cea\explothe.exe" at 00000000-00003864-0000010C-5759477 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00003864-0000010C-17443763 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00003864-0000010C-17448006 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00003864-0000010C-18254355 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00003864-0000010C-1825860834:T793,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION")35:T5b9,"2dI7778.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00000628) "2dI7778.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00000628) "2dI7778.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00000628) "2dI7778.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00000628) "2dI7778.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00000628) "2dI7778.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00000628) "AppLaunch.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002088) "AppLaunch.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002088) "AppLaunch.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00002088) "5vx9fn0.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001932) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003864) "6ka0eY3.exe" called "CreateDirectoryW" with parameter %TEMP%\252C.tmp (UID: 00000000-00002868) "6ka0eY3.exe" called "CreateDirectoryW" with parameter %TEMP%\252C.tmp\252D.tmp (UID: 00000000-00002868)36:T709,"file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\HA3aE65.exe" - (UID: 00000000-00003004) "file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\6ka0eY3.exe" - (UID: 00000000-00003004) "HA3aE65.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\Xx5lZ48.exe" - (UID: 00000000-00003904) "HA3aE65.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5vx9fn0.exe" - (UID: 00000000-00003904) "Xx5lZ48.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\AC6JZ27.exe" - (UID: 00000000-00001388) "Xx5lZ48.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4id504yr.exe" - (UID: 00000000-00001388) "AC6JZ27.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\Sr7kI69.exe" - (UID: 00000000-00000176) "AC6JZ27.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3Zf97dE.exe" - (UID: 00000000-00000176) "Sr7kI69.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\1pq69xq8.exe" - (UID: 00000000-00001828) "Sr7kI69.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\2dI7778.exe" - (UID: 00000000-00001828) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00002152) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00002152) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo Y"" - (UID: 00000000-00001468) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "%OSUSER%:N"" - (UID: 00000000-00001468) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "%OSUSER%:R" /E" - (UID: 00000000-00001468)37:T7a43,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003004) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003004) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003004) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003004) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003004) "HA3aE65.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003904) "Xx5lZ48.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001388) "Xx5lZ48.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001388) "Xx5lZ48.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001388) "Xx5lZ48.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001388) "Xx5lZ48.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001388) "AC6JZ27.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000176) "AC6JZ27.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000176) "AC6JZ27.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000176) "AC6JZ27.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000176) "AC6JZ27.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000176) "Sr7kI69.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001828) "Sr7kI69.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001828) "Sr7kI69.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001828) "Sr7kI69.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001828) "Sr7kI69.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001828) "1pq69xq8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002008) "1pq69xq8.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002008) "2dI7778.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00000628) "2dI7778.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000628) "3Zf97dE.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001308) "3Zf97dE.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001308) "3Zf97dE.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001308) "3Zf97dE.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001308) "3Zf97dE.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001308) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000408) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000408) "4id504yr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002876) "4id504yr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002876) "4id504yr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002876) "4id504yr.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002876) "4id504yr.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002876) "4id504yr.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002876) "4id504yr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002876) "4id504yr.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002876) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00002088) "AppLaunch.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00002088) "5vx9fn0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001932) "5vx9fn0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001932) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003864) "explothe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003864) "6ka0eY3.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\6ka0eY3.exe (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter Kernel32.DLL (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002868) "6ka0eY3.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002868) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00002152) "cmd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002152) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\schtasks.exe (UID: 00000000-00003624) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003624) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003624) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001468) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001468) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001468) "cacls.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00001592) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001592) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001592) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001592) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001592) "cacls.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001000) "cacls.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00001000) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001000) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001000) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001000) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001000) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001000) "cacls.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000312) "cacls.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00000312) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000312) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000312) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000312) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000312) "cacls.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000312) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000612)38:Ta11,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "file") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00001828.00000724.343997.00090000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigi2" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.65940.000A0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.65940.000A0000.00000004.mdmp, 00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BB0000.00000004.mdmp, 00000000-00000176.00000000.65940.00E40000.00000004.mdmp, 00000000-00000176.00000001.67003.000A0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.00BB0000.00000004.mdmp, 00000000-00000176.00000001.67003.00E40000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "evateCreateProcess U" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitig" (Indicator: "CreateProcess"; Source: "00000000-00000176.00000001.67003.000A0000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000612.00000000.69188.00110000.00000004.mdmp, 00000000-00000612.00000001.71112.00110000.00000004.mdmp, 00000000-00000612.00000002.73032.00110000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000612.00000000.69188.00110000.00000004.mdmp, 00000000-00000612.00000001.71112.00110000.00000004.mdmp, 00000000-00000612.00000002.73032.00110000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp")39:T51d,WaitForSingleObject@KERNEL32.DLL at 00000000-00003004-3212-37-012B3FEF Sleep@KERNEL32.DLL at 00000000-00003004-3212-11-012B6A60 MsgWaitForMultipleObjects at 00000000-00001388-7387-95-001C3680 Sleep@KERNEL32.DLL at 00000000-00001388-7387-11-001C6A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00001388-7387-37-001C3FEF Sleep@KERNEL32.DLL at 00000000-00001828-11146-11-00826A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00001828-11146-37-00823FEF Sleep@KERNEL32.DLL at 00000000-00002008-13488-38-0040E76A Sleep@KERNEL32.DLL at 00000000-00002008-13488-65-00411CBA Sleep@KERNEL32.DLL at 00000000-00002008-13488-273-00411D06 Sleep@KERNEL32.DLL at 00000000-00002008-13488-305-00411D54 Sleep@KERNEL32.DLL at 00000000-00002008-13488-54-00411C75 WaitForSingleObject@KERNEL32.DLL at 00000000-00000628-16391-473-0038B04D Sleep@KERNEL32.DLL at 00000000-00002868-10044-227-0040DA43 WaitForSingleObject@KERNEL32.DLL at 00000000-00002868-10044-278-004053EA Sleep@KERNEL32.DLL at 00000000-00002868-10044-281-00405532 Sleep@KERNEL32.DLL at 00000000-00002868-10044-200-00409311 WaitForSingleObject@KERNEL32.DLL at 00000000-00002868-10044-279-004053C7 WaitForSingleObject@KERNEL32.DLL at 00000000-00002868-10044-269-00405492 RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00002868-10044-89-004120823a:T571,LoadLibraryA@KERNEL32.DLL at 00000000-00003004-3212-33-012B2F1D LoadLibraryA@KERNEL32.DLL at 00000000-00003004-3212-73-012B17EE LoadLibraryA@KERNEL32.DLL at 00000000-00003004-3212-42-012B202A LoadLibraryExA@KERNEL32.DLL at 00000000-00003004-3212-41-012B6495 LoadLibraryA@KERNEL32.DLL at 00000000-00001388-7387-112-001C4224 LoadLibraryA@KERNEL32.DLL at 00000000-00001388-7387-42-001C202A LoadLibraryA@KERNEL32.DLL at 00000000-00001388-7387-73-001C17EE LoadLibraryA@KERNEL32.DLL at 00000000-00001388-7387-33-001C2F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00001388-7387-41-001C6495 LoadLibraryA@KERNEL32.DLL at 00000000-00001828-11146-73-008217EE LoadLibraryExA@KERNEL32.DLL at 00000000-00001828-11146-41-00826495 LoadLibraryA@KERNEL32.DLL at 00000000-00001828-11146-42-0082202A LoadLibraryA@KERNEL32.DLL at 00000000-00001828-11146-33-00822F1D LoadLibraryA@KERNEL32.DLL at 00000000-00002008-13488-259-004019F0 LoadLibraryA@KERNEL32.DLL at 00000000-00002008-13488-40-00413B7E LoadLibraryExW@KERNEL32.DLL at 00000000-00000628-16391-166-00374273 LoadLibraryExW@KERNEL32.DLL at 00000000-00002868-10044-309-00401B8F LoadLibraryW@KERNEL32.DLL at 00000000-00002868-10044-293-0040A83A LoadLibraryW@KERNEL32.DLL at 00000000-00002868-10044-227-0040DA43 LoadLibraryW@KERNEL32.DLL at 00000000-00002868-10044-297-0040A756 LoadLibraryW@KERNEL32.DLL at 00000000-00002868-10044-201-004093553b:T1398d,Found reference to API (Indicator: "CheckTokenMembership"; File: "file") Found reference to API (Indicator: "HeapSetInformation"; File: "file") Found reference to API (Indicator: "DecryptFileA"; File: "file") Found reference to API (Indicator: "SHBrowseForFolder"; File: "file") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "RegDeleteValueA"; File: "file") Found reference to API (Indicator: "RegOpenKeyExA"; File: "file") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "file") Found reference to API (Indicator: "FreeSid"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "RegSetValueExA"; File: "file") Found reference to API (Indicator: "RegCreateKeyExA"; File: "file") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "file") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API (Indicator: "RegQueryValueExA"; File: "file") Found reference to API (Indicator: "EqualSid"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API (Indicator: "GetShortPathNameA"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "FindFirstFileA"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "FindNextFileA"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "LocalAlloc"; File: "file") Found reference to API (Indicator: "lstrcmpA"; File: "file") Found reference to API (Indicator: "CompareStringA"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "GetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "DeleteFileA"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "file") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "file") Found reference to API (Indicator: "SetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "RemoveDirectoryA"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "CreateDirectoryA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "SizeofResource"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetDriveTypeA"; File: "file") Found reference to API (Indicator: "LoadLibraryExA"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "FindResourceA"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "GetVolumeInformationA"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "FreeResource"; File: "file") Found reference to API (Indicator: "GetVersion"; File: "file") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "GetTempPathA"; File: "file") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "TerminateThread"; File: "file") Found reference to API (Indicator: "GetVersionExA"; File: "file") Found reference to API (Indicator: "LockResource"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "LoadResource"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "CreateProcessA"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "GetTempFileNameA"; File: "file") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateEventA"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "GetDeviceCaps"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "CharUpperA"; File: "file") Found reference to API (Indicator: "ExitWindowsEx"; File: "file") Found reference to API (Indicator: "MessageBeep"; File: "file") Found reference to API (Indicator: "CharPrevA"; File: "file") Found reference to API (Indicator: "LoadStringA"; File: "file") Found reference to API (Indicator: "CharNextA"; File: "file") Found reference to API (Indicator: "EnableWindow"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "PeekMessageA"; File: "file") Found reference to API (Indicator: "SendMessageA"; File: "file") Found reference to API (Indicator: "MessageBoxA"; File: "file") Found reference to API (Indicator: "SetWindowTextA"; File: "file") Found reference to API (Indicator: "GetWindowLongA"; File: "file") Found reference to API (Indicator: "CallWindowProcA"; File: "file") Found reference to API (Indicator: "SetWindowLongA"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "SetWindowPos"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "GetWindowRect"; File: "file") Found reference to API (Indicator: "DispatchMessageA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "file") Found reference to API (Indicator: "VerQueryValueA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "file") Found reference to API (Indicator: "MulDiv"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "EncodePointer"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "00000000-00002008.00000000.66011.00401000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00000628.00000001.66648.00371000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00000628.00000001.66648.00371000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00000628.00000001.66648.00371000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00000628.00000001.66648.00371000.00000020.mdmp") Found reference to API (Indicator: "GetWindowDC"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetClassName"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLong"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLong"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItem"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "LoadCursor"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "InsertMenu"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowEx"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "RegisterHotKey"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00002876.00000001.67369.001A9000.00000004.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "RtlGetVersion"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapCreate"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapDestroy"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumResourceTypesW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumResourceNamesW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "FindResourceW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetVersionExW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedExchange"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "UnregisterWait"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "PathAddBackslashW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "PathRenameExtensionW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "PathRemoveBackslashW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "CharUpperW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "CharLowerW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "UnregisterClassW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadIconW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadCursorW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFocus"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "BringWindowToTop"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "TranslateMessage"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "DispatchMessageW"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "IsWindowVisible"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumWindows"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "InterlockedDecrement"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetModuleHandleA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "Module32Next"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "Module32First"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetProcessHeap"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetCommandLineA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "VirtualFree"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "VirtualAlloc"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetConsoleCP"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetConsoleMode"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "InterlockedIncrement"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "FlushFileBuffers"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "SetHandleCount"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetStartupInfoA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "RtlUnwind"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetCPInfo"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetACP"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetOEMCP"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "IsValidCodePage"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "CompareStringW"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "WriteConsoleA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "WriteConsoleW"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "SetStdHandle"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetLocaleInfoA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "LCMapStringA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "LCMapStringW"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetStringTypeA"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "GetStringTypeW"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "SetEndOfFile"; File: "1pq69xq8.exe.3231849778") Found reference to API (Indicator: "FindFirstFileExW"; File: "2dI7778.exe.397259308") Found reference to API (Indicator: "FindNextFileW"; File: "2dI7778.exe.397259308") Found reference to API (Indicator: "SetFilePointerEx"; File: "2dI7778.exe.397259308") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000176.00000001.67003.00BC1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000176.00000001.67003.00BC1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000176.00000001.67003.00BC1000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp, 00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00000612.00000002.73032.00311000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000612.00000002.73032.6E18F000.00000002.mdmp")3c:T4c0,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "file") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "file") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "file") Found reference to API "LockResource" (Indicator: "LockResource"; File: "file") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "file") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "00000000-00002868.00000000.68071.00401000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000176.00000000.65940.00BCA000.00000002.mdmp")3d:T45c,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000000.65940.00BCA000.00000002.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000176.00000000.65940.000B0000.00000004.mdmp, 00000000-00000176.00000001.67003.000B0000.00000004.mdmp")3e:T1e03,"file.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "file.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Xx5lZ48.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Xx5lZ48.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AC6JZ27.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AC6JZ27.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Sr7kI69.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Sr7kI69.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "1pq69xq8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "2dI7778.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "3Zf97dE.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "3Zf97dE.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "3Zf97dE.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4id504yr.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4id504yr.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "4id504yr.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "4id504yr.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "5vx9fn0.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "explothe.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "6ka0eY3.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "6ka0eY3.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cacls.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]3f:T671,"file" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "HA3aE65.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4id504yr.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Xx5lZ48.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3Zf97dE.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "AC6JZ27.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Sr7kI69.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5vx9fn0.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2dI7778.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip_1_.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT40:Ta3c,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "file") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "file") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "252E.bat") file/memory contains long string with (Indicator: "youtube"; File: "LBOK1317.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_1_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "SN6O5BDO.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921722083261443106786196376900931065058VISITOR_INFO1_LIVEhB5RSPdOt7kyoutube.com/9217704435203110125596376900931065058" (Indicator: "youtube"; File: "K1JDG92O.txt") Found string "0lZZi6S1W0GfHAwjc..BlM1BM.s_.AAA.0.0.BlM1BM.AWVp84dZCH4facebook.com/921737333760031083150333489509831065053TFAzZVgr1S8d_QU46vDXH_ljfacebook.com/9217191779174431145511273673909831065053" (Indicator: "facebook.com"; File: "MYBC341T.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921722083261443106786196376900931065058" (Indicator: "youtube"; File: "9RMKTXP7.txt") Found string "CheckConnectionTempCookie290631674accounts.youtube.com/accounts/2147484752196473100831065152186596963031065152" (Indicator: "youtube"; File: "6LGGCOI3.txt") Found string "CheckConnectionTempCookie35412460accounts.youtube.com/accounts/2147484752323662412831065057314665229331065057" (Indicator: "youtube"; File: "JOGM4QWS.txt") Found string "TFAzZVgr1S8d_QU46vDXH_ljfacebook.com/9217191779174431145511273673909831065053" (Indicator: "facebook.com"; File: "2JXXTX58.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "I8KNDE4G.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")41:T690d,"file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "file.exe" loaded module "KERNEL32" at base 76750000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6e170000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "HA3aE65.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6bdf0000 "HA3aE65.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "Xx5lZ48.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "Xx5lZ48.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Xx5lZ48.exe" loaded module "KERNEL32" at base 76750000 "Xx5lZ48.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Xx5lZ48.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6e170000 "Xx5lZ48.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "AC6JZ27.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "AC6JZ27.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AC6JZ27.exe" loaded module "KERNEL32" at base 76750000 "AC6JZ27.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AC6JZ27.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6bdf0000 "AC6JZ27.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "Sr7kI69.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "Sr7kI69.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Sr7kI69.exe" loaded module "KERNEL32" at base 76750000 "Sr7kI69.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Sr7kI69.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6e170000 "Sr7kI69.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "1pq69xq8.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "1pq69xq8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "1pq69xq8.exe" loaded module "KERNEL32" at base 76750000 "1pq69xq8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "1pq69xq8.exe" loaded module "MSCOREE.DLL" at base 72a40000 "1pq69xq8.exe" loaded module "ADVAPI32.DLL" at base 76550000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 729b0000 "1pq69xq8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "1pq69xq8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 65560000 "1pq69xq8.exe" loaded module "USER32.DLL" at base 77ec0000 "1pq69xq8.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1pq69xq8.exe" loaded module "SHLWAPI.DLL" at base 76320000 "1pq69xq8.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "1pq69xq8.exe" loaded module "PSAPI.DLL" at base 775b0000 "1pq69xq8.exe" loaded module "KERNEL32.DLL" at base 76750000 "1pq69xq8.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 72a40000 "1pq69xq8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 64150000 "1pq69xq8.exe" loaded module "RPCRT4.DLL" at base 764a0000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1pq69xq8.exe" loaded module "OLE32.DLL" at base 761c0000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "1pq69xq8.exe" loaded module "OLEAUT32.DLL" at base 77870000 "1pq69xq8.exe" loaded module "AMSI.DLL" at base 0 "1pq69xq8.exe" loaded module "CRYPTSP.DLL" at base 75650000 "1pq69xq8.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 753e0000 "1pq69xq8.exe" loaded module "CRYPTBASE.DLL" at base 75b40000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "1pq69xq8.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73860000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 66500000 "1pq69xq8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 636f0000 "1pq69xq8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 661a0000 "1pq69xq8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62880000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6e180000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "1pq69xq8.exe" loaded module "NTDLL.DLL" at base 77d40000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "1pq69xq8.exe" loaded module "SHELL32.DLL" at base 76830000 "1pq69xq8.exe" loaded module "VERSION.DLL" at base 750e0000 "1pq69xq8.exe" loaded module "SSPICLI.DLL" at base 75ad0000 "1pq69xq8.exe" loaded module "ADVAPI32" at base 76550000 "1pq69xq8.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "1pq69xq8.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77590000 "1pq69xq8.exe" loaded module "RPCRTREMOTE.DLL" at base 75be0000 "2dI7778.exe" loaded module "KERNEL32.DLL" at base 76750000 "2dI7778.exe" loaded module "PROFAPI.DLL" at base 75c50000 "2dI7778.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70770000 "2dI7778.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75f40000 "2dI7778.exe" loaded module "WS2_32.DLL" at base 77960000 "2dI7778.exe" loaded module "WINHTTP.DLL" at base 71e70000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75610000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75600000 "2dI7778.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77590000 "2dI7778.exe" loaded module "IPHLPAPI.DLL" at base 73fa0000 "2dI7778.exe" loaded module "URLMON.DLL" at base 76600000 "2dI7778.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72600000 "2dI7778.exe" loaded module "DNSAPI.DLL" at base 754d0000 "2dI7778.exe" loaded module "RPCRT4.DLL" at base 764a0000 "2dI7778.exe" loaded module "CRYPTBASE.DLL" at base 75b40000 "2dI7778.exe" loaded module "DHCPCSVC6.DLL" at base 73eb0000 "2dI7778.exe" loaded module "CLBCATQ.DLL" at base 77500000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 75170000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6e330000 "2dI7778.exe" loaded module "OLE32.DLL" at base 761c0000 "2dI7778.exe" loaded module "DHCPCSVC.DLL" at base 73de0000 "2dI7778.exe" loaded module "RASADHLP.DLL" at base 722a0000 "2dI7778.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77590000 "2dI7778.exe" loaded module "ADVAPI32.DLL" at base 76550000 "2dI7778.exe" loaded module "CRYPTSP.DLL" at base 75650000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 753e0000 "2dI7778.exe" loaded module "RPCRTREMOTE.DLL" at base 75be0000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d2c0000 "2dI7778.exe" loaded module "OLEAUT32.DLL" at base 77870000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77870000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73ed0000 "2dI7778.exe" loaded module "COMCTL32.DLL" at base 74b40000 "2dI7778.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77960000 "2dI7778.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "3Zf97dE.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "3Zf97dE.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "3Zf97dE.exe" loaded module "KERNEL32" at base 76750000 "3Zf97dE.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "3Zf97dE.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6be20000 "3Zf97dE.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "3Zf97dE.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AppLaunch.exe" loaded module "KERNEL32" at base 76750000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6be20000 "4id504yr.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "4id504yr.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75cb0000 "4id504yr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "4id504yr.exe" loaded module "KERNEL32" at base 76750000 "4id504yr.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75cb0000 "4id504yr.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "4id504yr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "4id504yr.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "4id504yr.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 72a40000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 775b0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76750000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 639a0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 764a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 761c0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 75b40000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74700000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 738e0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 662c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62f40000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 65b60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61830000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76550000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 74700000 "AppLaunch.exe" loaded module "USER32.DLL" at base 77ec0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61010000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 661b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60890000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 738c0000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77d40000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 76830000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77590000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75c50000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 75760000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 75650000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 753e0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77940000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 723e0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 76450000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 65740000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5fc50000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e860000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6c150000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 76320000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 65600000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75cb0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 62db0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 62cc0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "VERSION.DLL" at base 750e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 629e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5e550000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6e180000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 62920000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6b970000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 77960000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75610000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 75170000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75600000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "AppLaunch.exe" loaded module "SECUR32.DLL" at base 75990000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 75ad0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5e420000 "AppLaunch.exe" loaded module "CLBCATQ.DLL" at base 77500000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77590000 "AppLaunch.exe" loaded module "RPCRTREMOTE.DLL" at base 75be0000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 77870000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 5c390000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 6c200000 "5vx9fn0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74700000 "5vx9fn0.exe" loaded module "ADVAPI32.DLL" at base 76550000 "5vx9fn0.exe" loaded module "PROPSYS.DLL" at base 748e0000 "5vx9fn0.exe" loaded module "OLE32.DLL" at base 761c0000 "5vx9fn0.exe" loaded module "COMCTL32.DLL" at base 74b40000 "5vx9fn0.exe" loaded module "OLEAUT32.DLL" at base 77870000 "5vx9fn0.exe" loaded module "SHELL32.DLL" at base 76830000 "5vx9fn0.exe" loaded module "CLBCATQ.DLL" at base 77500000 "5vx9fn0.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 748e0000 "5vx9fn0.exe" loaded module "NTMARTA.DLL" at base 74fa0000 "5vx9fn0.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77590000 "5vx9fn0.exe" loaded module "PROFAPI.DLL" at base 75c50000 "5vx9fn0.exe" loaded module "APPHELP.DLL" at base 75af0000 "5vx9fn0.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e570000 "5vx9fn0.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76830000 "5vx9fn0.exe" loaded module "SETUPAPI.DLL" at base 775c0000 "5vx9fn0.exe" loaded module "RPCRT4.DLL" at base 764a0000 "5vx9fn0.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76600000 "5vx9fn0.exe" loaded module "SECUR32.DLL" at base 75990000 "5vx9fn0.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75f30000 "5vx9fn0.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70770000 "5vx9fn0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "5vx9fn0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "explothe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "explothe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "explothe.exe" loaded module "KERNEL32" at base 76750000 "explothe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "explothe.exe" loaded module "OLE32.DLL" at base 761c0000 "explothe.exe" loaded module "CRYPTBASE.DLL" at base 75b40000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74700000 "explothe.exe" loaded module "ADVAPI32.DLL" at base 76550000 "explothe.exe" loaded module "PROPSYS.DLL" at base 748e0000 "explothe.exe" loaded module "COMCTL32.DLL" at base 74b40000 "explothe.exe" loaded module "OLEAUT32.DLL" at base 77870000 "explothe.exe" loaded module "APPHELP.DLL" at base 75af0000 "explothe.exe" loaded module "CLBCATQ.DLL" at base 77500000 "explothe.exe" loaded module "KERNEL32.DLL" at base 76750000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6aab0000 "explothe.exe" loaded module "SETUPAPI.DLL" at base 775c0000 "explothe.exe" loaded module "RPCRT4.DLL" at base 764a0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 748e0000 "explothe.exe" loaded module "NTMARTA.DLL" at base 74fa0000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77590000 "explothe.exe" loaded module "PROFAPI.DLL" at base 75c50000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75f30000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "explothe.exe" loaded module "SSPICLI.DLL" at base 75ad0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76600000 "explothe.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77590000 "explothe.exe" loaded module "SECUR32.DLL" at base 75990000 "explothe.exe" loaded module "SHELL32.DLL" at base 76830000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70770000 "explothe.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75f40000 "explothe.exe" loaded module "WINHTTP.DLL" at base 71e70000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75610000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6e330000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 75170000 "explothe.exe" loaded module "CRYPTSP.DLL" at base 75650000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 753e0000 "explothe.exe" loaded module "DHCPCSVC6.DLL" at base 73eb0000 "explothe.exe" loaded module "IPHLPAPI.DLL" at base 73fa0000 "explothe.exe" loaded module "DNSAPI.DLL" at base 754d0000 "explothe.exe" loaded module "DHCPCSVC.DLL" at base 73de0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d2c0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73ed0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77960000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 77a90000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77870000 "6ka0eY3.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "6ka0eY3.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "6ka0eY3.exe" loaded module "KERNEL32" at base 76750000 "6ka0eY3.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "6ka0eY3.exe" loaded module "KERNEL32.DLL" at base 76750000 "6ka0eY3.exe" loaded module "SHELL32.DLL" at base 76830000 "6ka0eY3.exe" loaded module "OLE32.DLL" at base 761c0000 "6ka0eY3.exe" loaded module "ADVAPI32.DLL" at base 76550000 "6ka0eY3.exe" loaded module "PROPSYS.DLL" at base 748e0000 "6ka0eY3.exe" loaded module "COMCTL32.DLL" at base 74b40000 "6ka0eY3.exe" loaded module "OLEAUT32.DLL" at base 77870000 "6ka0eY3.exe" loaded module "CLBCATQ.DLL" at base 77500000 "6ka0eY3.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 748e0000 "6ka0eY3.exe" loaded module "NTMARTA.DLL" at base 74fa0000 "6ka0eY3.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77590000 "6ka0eY3.exe" loaded module "PROFAPI.DLL" at base 75c50000 "6ka0eY3.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76600000 "6ka0eY3.exe" loaded module "SECUR32.DLL" at base 75990000 "6ka0eY3.exe" loaded module "RPCRT4.DLL" at base 764a0000 "6ka0eY3.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75f30000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 76550000 "cmd.exe" loaded module "SHELL32.DLL" at base 76830000 "cmd.exe" loaded module "OLE32.DLL" at base 761c0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74700000 "cmd.exe" loaded module "PROPSYS.DLL" at base 748e0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76750000 "cmd.exe" loaded module "OLEAUT32.DLL" at base 77870000 "cmd.exe" loaded module "APPHELP.DLL" at base 75af0000 "cmd.exe" loaded module "COMCTL32.DLL" at base 74b40000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6aab0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72600000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75f40000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76750000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75af0000 "cmd.exe" loaded module "SETUPAPI.DLL" at base 775c0000 "cmd.exe" loaded module "RPCRT4.DLL" at base 764a0000 "cmd.exe" loaded module "URLMON.DLL" at base 76600000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 748e0000 "cmd.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 667c0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76830000 "cmd.exe" loaded module "USER32.DLL" at base 77ec0000 "cmd.exe" loaded module "IERTUTIL.DLL" at base 75f80000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 76750000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 75b40000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74700000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76550000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77590000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 74270000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 76750000 "cacls.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77940000 "cacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "cacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cacls.exe" loaded module "KERNEL32" at base 76750000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cacls.exe" loaded module "GDI32.DLL" at base 76450000 "cacls.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77590000 "cacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6be20000 "cacls.exe" loaded module "KERNEL32.DLL" at base 76750000 "cacls.exe" loaded module "RPCRT4.DLL" at base 764a0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71610000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "rundll32.exe" loaded module "KERNEL32" at base 76750000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6be2000042:T4c4,"file.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "HA3aE65.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "Xx5lZ48.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "AC6JZ27.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "Sr7kI69.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "1pq69xq8.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "2dI7778.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "3Zf97dE.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "AppLaunch.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "4id504yr.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "5vx9fn0.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "explothe.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "6ka0eY3.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "cacls.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A0000 "rundll32.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 764A000043:T116d,"file" was detected as "Microsoft Cabinet" and name: "sfx" "file" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Cabinet File" and name: "Archive" "file" was detected as "Microsoft Linker" and name: "Linker" "HA3aE65.exe" was detected as "Microsoft Cabinet" and name: "sfx" "HA3aE65.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "HA3aE65.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "HA3aE65.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "HA3aE65.exe" was detected as "Microsoft Linker" and name: "Linker" "4id504yr.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4id504yr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4id504yr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4id504yr.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4id504yr.exe" was detected as "Microsoft Linker" and name: "Linker" "Xx5lZ48.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Xx5lZ48.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Xx5lZ48.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Xx5lZ48.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Xx5lZ48.exe" was detected as "Microsoft Linker" and name: "Linker" "3Zf97dE.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Zf97dE.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Zf97dE.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Zf97dE.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Zf97dE.exe" was detected as "Microsoft Linker" and name: "Linker" "AC6JZ27.exe" was detected as "Microsoft Cabinet" and name: "sfx" "AC6JZ27.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AC6JZ27.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AC6JZ27.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "AC6JZ27.exe" was detected as "Microsoft Linker" and name: "Linker" "Sr7kI69.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Sr7kI69.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Sr7kI69.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Sr7kI69.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Sr7kI69.exe" was detected as "Microsoft Linker" and name: "Linker" "5vx9fn0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5vx9fn0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5vx9fn0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5vx9fn0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5vx9fn0.exe" was detected as "Microsoft Linker" and name: "Linker" "1pq69xq8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1pq69xq8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1pq69xq8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1pq69xq8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1pq69xq8.exe" was detected as "Microsoft Linker" and name: "Linker" "2dI7778.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2dI7778.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2dI7778.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2dI7778.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2dI7778.exe" was detected as "Microsoft Linker" and name: "Linker" "clip_1_.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip_1_.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "6ka0eY3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6ka0eY3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6ka0eY3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6ka0eY3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6ka0eY3.exe" was detected as "Microsoft Linker" and name: "Linker"44:T11fb,"2dI7778.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "2dI7778.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "2dI7778.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "5vx9fn0.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5vx9fn0.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5vx9fn0.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "5vx9fn0.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "5vx9fn0.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "5vx9fn0.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "5vx9fn0.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explothe.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32")45:T1943,"file" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "HA3aE65.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4id504yr.exe" file has an entrypoint instructions - "jmp 0x44a090,jmp 0x4611c4,jmp 0x452690,jmp 0x43e229,jmp 0x42a03b,jmp 0x4ad040,jmp 0x43e6e7,jmp 0x461fa7,jmp 0x414ef0,jmp 0x4b4969,jmp 0x424d0e,jmp 0x44ac80,jmp 0x423949,jmp 0x45b030,jmp 0x43502b,jmp 0x45c466,jmp 0x4263a8,jmp 0x422a06,jmp 0x49ad5f,jmp 0x418320," "Xx5lZ48.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Zf97dE.exe" file has an entrypoint instructions - "jmp 0x44a0a0,jmp 0x4611d4,jmp 0x4526a0,jmp 0x43e239,jmp 0x42a04b,jmp 0x4ad050,jmp 0x43e6f7,jmp 0x461fb7,jmp 0x414ef0,jmp 0x4b4979,jmp 0x424d1e,jmp 0x44ac90,jmp 0x423959,jmp 0x45b040,jmp 0x43503b,jmp 0x45c476,jmp 0x4263b8,jmp 0x422a16,jmp 0x49ad6f,jmp 0x418320," "AC6JZ27.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Sr7kI69.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5vx9fn0.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "1pq69xq8.exe" file has an entrypoint instructions - "call 0x412a15,jmp 0x40cbdd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x41f058,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x40cd6e,test byte ptr [eax], 8,je 0x40cd6e,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x41b000],leave ,ret 8,ret ,mov eax, 0x413563,mov dword ptr [0x4228e4], eax," "2dI7778.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "clip_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax," "6ka0eY3.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x412015,lea edi, [esi - 0x11015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x41bca8,inc esi,inc esi,push ebx,push 0x19a62,push edi,add ebx, 4,push ebx,push 0x9c78,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"46:T936,Process "HA3aE65.exe" (UID: 00000000-00003904) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "cmd.exe" (UID: 00000000-00002152) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "schtasks.exe" (UID: 00000000-00003624) was launched with missing environment variables: "b2eincfilepath" Process "cmd.exe" (UID: 00000000-00002628) was launched with new environment variables: "PROMPT="$P$G"" Process "iexplore.exe" (UID: 00000000-00003024) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003024) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00001592) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00001592) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00004052) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00004052) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00001000) was launched with modified environment variables: "Path" Process "cacls.exe" (UID: 00000000-00001000) was launched with missing environment variables: "b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00003000) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003000) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00001936) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00001936) was launched with missing environment variables: "b2eincfilepath" Process "explothe.exe" (UID: 00000000-00003888) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER" Process "cacls.exe" (UID: 00000000-00000312) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "rundll32.exe" (UID: 00000000-00000612) was launched with missing environment variables: "PROMPT" Process "explothe.exe" (UID: 00000000-00002612) was launched with missing environment variables: "__COMPAT_LAYER"47:T7c2,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "HA3aE65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "HA3aE65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Xx5lZ48.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Xx5lZ48.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AC6JZ27.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AC6JZ27.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Sr7kI69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Sr7kI69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1pq69xq8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1pq69xq8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1pq69xq8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "1pq69xq8.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "2dI7778.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2dI7778.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3Zf97dE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3Zf97dE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4id504yr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4id504yr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")48:Tef7,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00001828.00000724.343997.00090000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003004-00000C25-38339551] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003004-00000BC1-38350695] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003904-00000BC1-38853611] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00001388-00000BC1-39281727] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00000176-00000BC1-39657168] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00001828-00000BC1-40241759] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002008-00000C25-41065220] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002008-00000C25-41257262] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002008-00000C25-41319492] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002008-00000C25-41368448] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002008-00000C25-41500030] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002008-00000C25-41537403] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002008-00000C25-41595152] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002008-00000C25-41733593] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002008-00000C25-41797468] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002008-00000C25-41848235] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002008-00000C25-41876078] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002008-00000C25-41918853] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002008-00000C25-41967472] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002008-00000C25-42109462] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002008-00000C25-42229440] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002008-00000C25-42268951] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002008-00000C25-43344962] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002088-00000C25-67030120]49:T836,Spawned process "HA3aE65.exe" (UID: 00000000-00003904) Spawned process "Xx5lZ48.exe" (UID: 00000000-00001388) Spawned process "AC6JZ27.exe" (UID: 00000000-00000176) Spawned process "Sr7kI69.exe" (UID: 00000000-00001828) Spawned process "1pq69xq8.exe" (UID: 00000000-00002008) Spawned process "2dI7778.exe" (UID: 00000000-00000628) Spawned process "3Zf97dE.exe" (UID: 00000000-00001308) Spawned process "AppLaunch.exe" (UID: 00000000-00000408) Spawned process "4id504yr.exe" (UID: 00000000-00002876) Spawned process "AppLaunch.exe" (UID: 00000000-00002088) Spawned process "5vx9fn0.exe" (UID: 00000000-00001932) Spawned process "explothe.exe" (UID: 00000000-00003864) Spawned process "6ka0eY3.exe" (UID: 00000000-00002868) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\252C.tmp\\252D.tmp\\252E.bat %TEMP%\\IXP000.TMP\\6ka ..." (UID: 00000000-00002152), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00003624) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00001468), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002628), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003024), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00001592), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00004052), Spawned process "iexplore.exe" with commandline "SCODEF:3024 CREDAT:275457 /prefetch:2" (UID: 00000000-00002440), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00001000), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003000), Spawned process "iexplore.exe" with commandline "SCODEF:4052 CREDAT:275457 /prefetch:2" (UID: 00000000-00003940), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00001936)4a:T836,Spawned process "HA3aE65.exe" (UID: 00000000-00003904) Spawned process "Xx5lZ48.exe" (UID: 00000000-00001388) Spawned process "AC6JZ27.exe" (UID: 00000000-00000176) Spawned process "Sr7kI69.exe" (UID: 00000000-00001828) Spawned process "1pq69xq8.exe" (UID: 00000000-00002008) Spawned process "2dI7778.exe" (UID: 00000000-00000628) Spawned process "3Zf97dE.exe" (UID: 00000000-00001308) Spawned process "AppLaunch.exe" (UID: 00000000-00000408) Spawned process "4id504yr.exe" (UID: 00000000-00002876) Spawned process "AppLaunch.exe" (UID: 00000000-00002088) Spawned process "5vx9fn0.exe" (UID: 00000000-00001932) Spawned process "explothe.exe" (UID: 00000000-00003864) Spawned process "6ka0eY3.exe" (UID: 00000000-00002868) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\252C.tmp\\252D.tmp\\252E.bat %TEMP%\\IXP000.TMP\\6ka ..." (UID: 00000000-00002152), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00003624) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe. ..." (UID: 00000000-00001468), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002628), Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003024), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:N"" (UID: 00000000-00001592), Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00004052), Spawned process "iexplore.exe" with commandline "SCODEF:3024 CREDAT:275457 /prefetch:2" (UID: 00000000-00002440), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "%OSUSER%:R" /E" (UID: 00000000-00001000), Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003000), Spawned process "iexplore.exe" with commandline "SCODEF:4052 CREDAT:275457 /prefetch:2" (UID: 00000000-00003940), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00001936)4b:T587c,"HA3aE65.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\HA3aE65.exe]- [targetUID: 00000000-00003904] "4id504yr.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4id504yr.exe]- [targetUID: 00000000-00002876] "Xx5lZ48.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Xx5lZ48.exe]- [targetUID: 00000000-00003904] "3Zf97dE.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3Zf97dE.exe]- [targetUID: 00000000-00001308] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "AC6JZ27.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\AC6JZ27.exe]- [targetUID: 00000000-00001388] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Sr7kI69.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Sr7kI69.exe]- [targetUID: 00000000-00001828] "5vx9fn0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5vx9fn0.exe]- [targetUID: 00000000-00003904] "1pq69xq8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1pq69xq8.exe]- [targetUID: 00000000-00002008] "2dI7778.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2dI7778.exe]- [targetUID: 00000000-00001828] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "6ka0eY3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\6ka0eY3.exe]- [targetUID: 00000000-00002868] "4aAhOWlwaXf_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "cred.dll" has type "HTML document ASCII text"- Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00003864] "252E.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\252C.tmp\252D.tmp\252E.bat]- [targetUID: 00000000-00002868] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "ROIFV8XL.js" has type "ASCII text with very long lines"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\ROIFV8XL.js]- [targetUID: 00000000-00002440] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "RNFuSb7tdaZ_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m__b__tp_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "RMM9CJ5J.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\RMM9CJ5J.htm]- [targetUID: 00000000-00004052] "WSISLY5J.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\WSISLY5J.htm]- [targetUID: 00000000-00003024] "m_ltDFwf_Rusgnf_Ctsu_UPKV3d_bPkrc_W2YXuc_pxq3x_IZ1fbc_soHxf_kSPLL_qPfo0c_yRXbo_bTi8wc_ywOR5c_PHUIyb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "uwjyy7pmA-B_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "bisOS4dl-mS_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "1xoiPcaOOYU_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "LgvwffuKmeX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "ju4lCUCaD5F_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xEUODc7mbZF_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_byfTOb_lsjVmc_LEikZe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "GLMTwJKTA1g_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "zI56j6esQGz_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "SeW64FDUgJN_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "BQn1Lzzcmjv_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "fpMCwgcFvo4_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_2_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DFFFE92302BB8F530C.TMP" has type "data"- [targetUID: N/A] "KFOmCnqEu92Fr1Mu4mxM_1_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "m_RqjULd_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00004052] "_tJ17sGyxOX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "imagestore.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00004052] "~DF2668D0B4EE62E050.TMP" has type "data"- [targetUID: N/A] "~DF15709E7FB0287F5F.TMP" has type "data"- Location: [%TEMP%\~DF15709E7FB0287F5F.TMP]- [targetUID: 00000000-00003024] "~DFB78E468186AD1743.TMP" has type "data"- Location: [%TEMP%\~DFB78E468186AD1743.TMP]- [targetUID: 00000000-00003024] "~DFE168DBE1EFC8F8E0.TMP" has type "data"- Location: [%TEMP%\~DFE168DBE1EFC8F8E0.TMP]- [targetUID: 00000000-00003024] "~DF9653B6176B6BB5C4.TMP" has type "data"- [targetUID: N/A] "~DFD91369A22FBF3FF0.TMP" has type "data"- Location: [%TEMP%\~DFD91369A22FBF3FF0.TMP]- [targetUID: 00000000-00004052] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 16064 version 1.1"- [targetUID: N/A] "lFK_RCKM9IT_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "_0BC7FD96-6FC0-11EE-919B-0050569114CC_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "C9n9XTZa3H8_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xqvNY4MTESs_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "30BCF8D79B1225AC4F40686E58D30D95" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\30BCF8D79B1225AC4F40686E58D30D95]- [targetUID: 00000000-00002440] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00002440] "rAl2Hl1fQTa_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_wg1P6b_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00002440] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "P8DLAFRlDfy_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced"- [targetUID: N/A] "MAz3ivwtIyN_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "jIUN0Hn2kpD_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "_0BC7FD94-6FC0-11EE-919B-0050569114CC_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._0BC7FD92-6FC0-11EE-919B-0050569114CC_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._823239C1-6FC1-11EE-919B-0050569114CC_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004052] "d4QqVJOdC1V_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_3B05C480-6FD1-11EE-919B-0050569114CC_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_62574640-706E-11EE-919B-0050569114CC_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_581BD725-6FCE-11EE-919B-0050569114CC_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "m_sOXFj_q0xTif_ZZ4WUe_1_.js" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "wYnUPpbC_DL_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "2W2z89vRC58_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_Wt6vjf_hhhU8_FCpbqb_WhJNk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "QJ_ErdZuyUE_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "m_ZwDk9d_RMhBfe_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yUtEQ4ajXZI_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "EQ0cyse2DGv_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "m_w9hDv_VwDzFe_A7fCU_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002440] "bpW4eEg-2_W_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "m_bm51tf_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002440] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002440] "7O04Eyj-1fg_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "E7ECSYHT.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\E7ECSYHT.txt]- [targetUID: 00000000-00004052] "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2]- [targetUID: 00000000-00002440] "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00002440] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00002440] "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00002440] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00004052] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00004052] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00004052] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002440] "35DDEDF268117918D1D277A171D8DF7B_1B752DF6198E90035E1D998D92649365" has type "data"- [targetUID: 00000000-00002440] "DWT2SXP5.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\DWT2SXP5.txt]- [targetUID: 00000000-00003024] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00004052] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00004052] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00002440] "E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_802691FEFBCBFDBC6638E7243774E081]- [targetUID: 00000000-00002440] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00004052] "F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_249A1AAD948A044308274CC39E5A79B2]- [targetUID: 00000000-00002440] "F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_2D1FA229671185E6CE5261A2A9B06982]- [targetUID: 00000000-00002440] "265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_3177CE6CD1B3852A6EC841765B1A16FB]- [targetUID: 00000000-00002440] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00002440] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00002440] "3NTCOI2D.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\3NTCOI2D.txt]- [targetUID: 00000000-00004052] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "LBOK1317.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LBOK1317.txt]- [targetUID: 00000000-00002440] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004052] "css_1_.css" has type "ASCII text"- [targetUID: N/A] "SN6O5BDO.txt" has type "ASCII text"- [targetUID: N/A] "CB00MPZS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\CB00MPZS.txt]- [targetUID: 00000000-00004052] "K1JDG92O.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\K1JDG92O.txt]- [targetUID: 00000000-00003940] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B]- [targetUID: 00000000-00002440] "5NLNWX4P.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\5NLNWX4P.txt]- [targetUID: 00000000-00002440] "6OFATTSI.htm" has type "gzip compressed data original size modulo 2^32 338"- [targetUID: N/A] "OHWFUEMO.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OHWFUEMO.txt]- [targetUID: 00000000-00004052] "MYBC341T.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\MYBC341T.txt]- [targetUID: 00000000-00002440] "70DAE932E3BCB3C00656A27B544BA9CA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00002440] "30BCF8D79B1225AC4F40686E58D30D95" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\30BCF8D79B1225AC4F40686E58D30D95]- [targetUID: 00000000-00002440] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00002440] "9RMKTXP7.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\9RMKTXP7.txt]- [targetUID: 00000000-00003940] "O0LYNXQ1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\O0LYNXQ1.txt]- [targetUID: 00000000-00002440] "JMS2Q72A.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\JMS2Q72A.txt]- [targetUID: 00000000-00002440] "TLCWOCZN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\TLCWOCZN.txt]- [targetUID: 00000000-00002440] "2VIGWHVS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2VIGWHVS.txt]- [targetUID: 00000000-00002440] "Z5BV6MPU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\Z5BV6MPU.txt]- [targetUID: 00000000-00002440] "HMRG8G5T.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HMRG8G5T.txt]- [targetUID: 00000000-00002440] "6LGGCOI3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6LGGCOI3.txt]- [targetUID: 00000000-00002440] "JOGM4QWS.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\JOGM4QWS.txt]- [targetUID: 00000000-00002440] "BSN1HOJ3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\BSN1HOJ3.txt]- [targetUID: 00000000-00003024] "OBESDRLU.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OBESDRLU.txt]- [targetUID: 00000000-00002440] "6F02B4H1.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6F02B4H1.txt]- [targetUID: 00000000-00002440] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "LRQ7L44T.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\LRQ7L44T.txt]- [targetUID: 00000000-00003024] "2JXXTX58.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\2JXXTX58.txt]- [targetUID: 00000000-00002440] "I8KNDE4G.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\I8KNDE4G.txt]- [targetUID: 00000000-00003940] "EM3GUXU8.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\EM3GUXU8.txt]- [targetUID: 00000000-00004052] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00003864] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00003864] "N3U62Z3M.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\N3U62Z3M.txt]- [targetUID: 00000000-00002440] "XHEDFL3Y.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\XHEDFL3Y.txt]- [targetUID: 00000000-00002440]4c:T798,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")4d:T5fa,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "")4e:T485,"file.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3004) "file.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3004) "HA3aE65.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3904) "HA3aE65.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3904) "Xx5lZ48.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 1388) "Xx5lZ48.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 1388) "AC6JZ27.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 176) "AC6JZ27.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 176) "Sr7kI69.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 1828) "Sr7kI69.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 1828) "1pq69xq8.exe" queries basic process information of the "C:\Windows\System32\en-US\KernelBase.dll.mui" (UID: 2008)4f:Tb8e,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "")50:T699,"file.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\ha3ae65.exe" "file.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6ka0ey3.exe" "HA3aE65.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\xx5lz48.exe" "HA3aE65.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5vx9fn0.exe" "Xx5lZ48.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\ac6jz27.exe" "Xx5lZ48.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4id504yr.exe" "AC6JZ27.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\sr7ki69.exe" "AC6JZ27.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3zf97de.exe" "Sr7kI69.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\1pq69xq8.exe" "Sr7kI69.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\2di7778.exe" "1pq69xq8.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1pq69xq8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1pq69xq8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "1pq69xq8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "1pq69xq8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "1pq69xq8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux"51:T682,"file.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "file.exe" trying to touch file "C:\file.exe.Local\" "file.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "file.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "file.exe" trying to touch file "C:\Cabinet.dll" "file.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "file.exe" trying to touch file "C:\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "file.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "file.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "file.exe" trying to touch file "C:\SspiCli.dll" "file.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "file.exe" trying to touch file "C:\WINSPOOL.DRV" "file.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "file.exe" trying to touch file "C:\MPR.dll" "file.exe" trying to touch file "C:\Windows\system32\MPR.dll" "file.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "file.exe" trying to touch file "C:\UxTheme.dll" "file.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "file.exe" trying to touch file "C:\WINMM.dll" "file.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "file.exe" trying to touch file "C:\samcli.dll" "file.exe" trying to touch file "C:\Windows\system32\samcli.dll" "file.exe" trying to touch file "C:\MSACM32.dll"52:T643,"file.exe" trying to access non-existent file "C:\Cabinet.dll" "file.exe" trying to access non-existent file "C:\VERSION.dll" "file.exe" trying to access non-existent file "C:\SspiCli.dll" "file.exe" trying to access non-existent file "C:\MPR.dll" "file.exe" trying to access non-existent file "C:\UxTheme.dll" "file.exe" trying to access non-existent file "C:\WINMM.dll" "file.exe" trying to access non-existent file "C:\samcli.dll" "file.exe" trying to access non-existent file "C:\MSACM32.dll" "file.exe" trying to access non-existent file "C:\sfc.dll" "file.exe" trying to access non-existent file "C:\sfc_os.DLL" "file.exe" trying to access non-existent file "C:\dwmapi.dll" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HA3aE65.exe" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6ka0eY3.exe" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"53:T841,"file.exe" trying to access non-existent file "C:\file.exe.Local\" "file.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "file.exe" trying to access non-existent file "C:\file.exe.Config" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.CONFIG" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "HA3aE65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HA3aE65.exe.Local\" "HA3aE65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "HA3aE65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HA3aE65.exe.Config" "HA3aE65.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "HA3aE65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HA3AE65.EXE.LOCAL" "HA3aE65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "HA3aE65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HA3AE65.EXE.CONFIG" "HA3aE65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Xx5lZ48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Xx5lZ48.exe.Local\" "Xx5lZ48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "Xx5lZ48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Xx5lZ48.exe.Config" "Xx5lZ48.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"54:T3242,Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKAConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxc9j3I_1S7Zx5oFmB3gIptNPTS0tFpbP01k7PqX5uyojwfG1lDqsMrFiVPzveau1EuvwzdaQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKAConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1190735428%3A1697861707858787&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKAConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKA"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-5417874174459294613&bl=boq_identityfrontendauthuiserver_20231015.08_p1&hl=en-US&_reqid=27598&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-1190735428:1697861707858787",null,null,"AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKA"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKA"; in File: "SSL") Found requests in header "GET /restart?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1190735428%3A1697861707858787&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:3RmrqfPcZd9767AioVMohHJl5GTreA:x5PcjTRaFEieyglj; NID=511=J4Y3T3tRsuTIsie7Cd3PiAs2R1VCmjhQGClBXBO-w0fsyxRe9UzcBkxBBzqg1NnYP2ZLmU8njrCDt-4EWEF4L430VrIKMLcdeG883dVdqdRnBRYVWXgKTGs6je4R67w0HXt4R35ji-mlg-qfDV6DftmGsXjCKyV4oLX7m_BYwOA"; in File: "SSL") Found requests in header "GET /ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:qHtq9LHaTaDp0XH4oy9vnNDraO9nxw:JL5OejKbZ_E6e3nj; NID=511=J4Y3T3tRsuTIsie7Cd3PiAs2R1VCmjhQGClBXBO-w0fsyxRe9UzcBkxBBzqg1NnYP2ZLmU8njrCDt-4EWEF4L430VrIKMLcdeG883dVdqdRnBRYVWXgKTGs6je4R67w0HXt4R35ji-mlg-qfDV6DftmGsXjCKyV4oLX7m_BYwOAConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:uIow0iJ78Ps6U-38m5cBInn-6QTElA:UF_UFigQCq-6iLRp; NID=511=J4Y3T3tRsuTIsie7Cd3PiAs2R1VCmjhQGClBXBO-w0fsyxRe9UzcBkxBBzqg1NnYP2ZLmU8njrCDt-4EWEF4L430VrIKMLcdeG883dVdqdRnBRYVWXgKTGs6je4R67w0HXt4R35ji-mlg-qfDV6DftmGsXjCKyV4oLX7m_BYwOA"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzQsPFyXE8lpN_u-CO1t6Jyi1zYVqdvPyZ5WAmYWoa8yAqr6X3POSnehhu3faLFR9yaPPfI&theme=glif&dsh=S-1476075590%3A1697861774078056 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:uIow0iJ78Ps6U-38m5cBInn-6QTElA:UF_UFigQCq-6iLRp; NID=511=J4Y3T3tRsuTIsie7Cd3PiAs2R1VCmjhQGClBXBO-w0fsyxRe9UzcBkxBBzqg1NnYP2ZLmU8njrCDt-4EWEF4L430VrIKMLcdeG883dVdqdRnBRYVWXgKTGs6je4R67w0HXt4R35ji-mlg-qfDV6DftmGsXjCKyV4oLX7m_BYwOA"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:uIow0iJ78Ps6U-38m5cBInn-6QTElA:UF_UFigQCq-6iLRp; NID=511=J4Y3T3tRsuTIsie7Cd3PiAs2R1VCmjhQGClBXBO-w0fsyxRe9UzcBkxBBzqg1NnYP2ZLmU8njrCDt-4EWEF4L430VrIKMLcdeG883dVdqdRnBRYVWXgKTGs6je4R67w0HXt4R35ji-mlg-qfDV6DftmGsXjCKyV4oLX7m_BYwOA"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=8195382914654326055&bl=boq_identityfrontendauthuiserver_20231015.08_p1&hl=en-US&_reqid=68065&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-1476075590:1697861774078056",null,null,"AVQVeyzQsPFyXE8lpN_u-CO1t6Jyi1zYVqdvPyZ5WAmYWoa8yAqr6X3POSnehhu3faLFR9yaPPfI"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:uIow0iJ78Ps6U-38m5cBInn-6QTElA:UF_UFigQCq-6iLRp; NID=511=J4Y3T3tRsuTIsie7Cd3PiAs2R1VCmjhQGClBXBO-w0fsyxRe9UzcBkxBBzqg1NnYP2ZLmU8njrCDt-4EWEF4L430VrIKMLcdeG883dVdqdRnBRYVWXgKTGs6je4R67w0HXt4R35ji-mlg-qfDV6DftmGsXjCKyV4oLX7m_BYwOA"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:uIow0iJ78Ps6U-38m5cBInn-6QTElA:UF_UFigQCq-6iLRp; NID=511=J4Y3T3tRsuTIsie7Cd3PiAs2R1VCmjhQGClBXBO-w0fsyxRe9UzcBkxBBzqg1NnYP2ZLmU8njrCDt-4EWEF4L430VrIKMLcdeG883dVdqdRnBRYVWXgKTGs6je4R67w0HXt4R35ji-mlg-qfDV6DftmGsXjCKyV4oLX7m_BYwOA"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yL/l/0,cross/GLMTwJKTA1g.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yX/l/0,cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yx/l/0,cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yI/r/4aAhOWlwaXf.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3i7M54/yv/l/en_US/uwjyy7pmA-B.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")55:Ta564,"GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 200 OKVary: Accept-EncodingContent-Encoding: gzipp3p: CP="Facebook has no P3P policy fb.me/p3p"Set-Cookie: sb=TFAzZVgr1S8d_QU46vDXH_lj; expires=Sun, 24-Nov-2024 04:15:08 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponlySet-Cookie: fr=0lZZi6S1W0GfHAwjc..BlM1BM.s_.AAA.0.0.BlM1BM.AWVp84dZCH4; expires=Fri, 19-Jan-2024 04:15:08 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponlyreporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img" "-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;document-policy: force-load-at-toppermissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()cross-origin-resource-policy: same-origincross-origin-opener-policy: unsafe-nonePragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: w54ndtda8FBsnAdrRJiCnuBu7RC0dqgAkCNCCEfDab3FAnG3Y/NbDAHmNWRQ6EqSDEVBtUiaQAkj/txp5UZOnw==Date: Sat," "21 Oct 2023 04:15:08 GMTAlt-Svc: h3=":443"; ma=86400Transfer-Encoding: chunkedConnection: keep-alive4501�ĽKo#Ͳ ��_�[��3�9�X�7՟�ŗ(Q$Ň(�շ�U�E�X�*eU�>f1�^o^��y�c`�,��,w��Fd֋5[��7+��U�[��ꉩ;7>��_�_�@��T�� ک�#+�5��T0-��0Fڧ_��Eu��S�s�TIH��t��@��)�TH��b�=4�#�p9(*G�ҟ~qTJl7aZ��O�<��b$|�=Su�e&��h�3��n�Dj��t�|V��ꗗ%15kyL�G(n��I>us!|I*G'�캹8�~��O__�J,��%��9xH=��pmcG8ё��@�xr�u��G��eךaS8*�S�y^�^M�^E�SKHϭ��QW��;.Rg�K��e�̉+�dŤ��9v��3O�1�g,��EQL��Z��\ J��V-��j�m��D�h��:�S�rG��j��YwR��^{D��_�>��}�z_~�m��|[66k�Er�ŮG͏�qK�\ɭN��촆]�ҩ�-�_��wr�^��}�H*I5�}� {��e^>�ɍ@}u��Z&L�L�)�臣��:z9��N��vwm�ݦ��f��F�k�Y>c�L+�ņ��u��0��il|��~�4mXb�*�T?��Ko��#ٶAT�LAJb#��{��+��e�Ďջ!qA�k%f��N,�;M�`Ss��qu=j��]��`��h��T�dŏSL&S��(�߆�"�^��1AHy��uf��A��vҐऑm�M�t��j��v��ι_��tw�b��ď!mpA��oa��0�!1pj��rN�i�E.Q�W�c]Q5��n�:T=��vz�M��i��w�I'K'wb��6'��U-ÊOy�U��2�b��Dǎ?^U:�F}0�ۭΥ��R��i�(L�Z�cQ2!�)L8)�b�.AH.q��h��%|j[�1]+��Y��fh�kb�1�w��0f�2�L%�$�LʛXuᓍ��`�':�c�d%ml��i-�#n�Բ1uק�59q��zh�ʦ�zx�\�̱j͹^|�a�Ȉ�Ħ��3�7$�6F�n_U��ro#�VW)��l��l��ˋ�aE��L�y��d�cd.��Q�V�r��62��>��oH�" "*Ff�+��ǔ��9�vo\^q2}�ѡ��(�i��ix��j��؋j3�t%�ڨ�eR�Sdsau�<�>`V_��Q=?�:?�"S3��jج��WA*eKR.?�p"%G8�^�B�T��$J%)Wʇ�YJ�T��A��>��&�U��P,��EV;�0VA��%)�R&��~��$��r�`1��͋��b�L�p�4)S�fs��|I�v��#��̗��=;$s<�EfknBR`��b��L2�=��P�燣�H4�'�?��: [B��׍�-�r+SM�z��R��z�|ʺS�%)�/��j�:��g�0�-�e��g�}>:��X��~�ѯ��A�ү�Ia��_�ڕj]��v�N�o�r��U�w�u�_�u��V�)$��Ѡթr�s��9�qk��z_��V�/��Wz�?r�ד+�A�٩��Ѡ�ȝ�X��Z��9��J}�|s�^�[U�r�2��o�?��Y��J�n�Z��a�\>�v�zM�v�z�N�3�+�a�/Wj�گW��nGH�m]�ֺ�w�ng 7��+��ޗ[y�kw+5�ւ6�4wZ7wr��;�~��}��V��:�+�P�3��oZ��p _Շ�Vu ��~��Jc(�;��v]�u��n�;R*�+�Si�jA�A�W�W�u��>T��j��R�nZ�;�Wi��^�5�B�r&w�CƢ8E��u��|��CƑ}�z��2"��+�F�%��Q�2:��*��Y��X�a�z5��gL�#�5��o��a�ۖ਩�׫�r�ۇQ�p��ڈ�`h�W�[W�Jz�R��A�/_��%��ng��j�˭�Y�V�u{�'[=�S�i5/�QSn�n��P��}u޽�sV�7��T��*��6�U�A�uvg�z��v�r�~=��ڰ�d�2�4�NWnuZC��ܬ�+�w��0�6�N��3t��P�TT\_�/��Wlt[ϖS��Js��y��.�3x��Ws8��N��˧LIIͮ��gwŎ�($�2�[��J��3.=k�t\(��y�ٿ�͏��ѦO}��پ��t��ƫI�/ϕ\u��p+�ڢS^��%`?Ӟ�͹��!)�j�SkҒ��b8-��H��9��[v��m�Y��[h��|�+Z:�I�Pk�ڴ��]�+��&�S��kyW)�f��0�r��u.��??'�ֹ��<�/Kk��K2�/�0�L��e��Z��Mן4p?��6(�K�|��/I��:S�3��Z�3d��+�%��fJ�q��Ս��teQ4N��u�_��q�/?��F�-�9��ע늍�r�4ͽ�˭�e5ږ��ZN��a�a-ngߏ�'��$��c�Iajf�=��P.�>�<�&w�>~��/"��Ũ�cCs��zI�˹,�0�M��t{��0K\4�c", "�P��K=�t�&gRg�:N��dr�b��I�B�;�V S��3�"��f��CT�y/ͱ��!�{�a��Aw8>A�%,�|}I�5GĄ�/�B&��5��K�_,�Mπ�,�2��G)6݊VQU�3]_Pc�R�ɕj�;��VM8D�]�bu��c"�E��K��~Έb2/�_��uE��If3��C>)8��[��"t��I��ӵ=p��S�k�_�[�\K�[��W�I&S�'9n�ӆE+�H[��r��$��t�S,s_˶�cM̾��U|If3e�=�A{��a��v��<�(��J8��DH�EUܳ�a��Z��,H��B�=�~`;G�g��/IA�m6��I��cI��+��K�CV�nm��O�Ѵ�N^��w�ma��F;�g"�Rm�L��U��>�l��l{V*�/g8GG/�9D��KRX�̘�n�J9^p$��*?�X,�-X�ض#k�t��bFs��Y��s�$�zgx�$se�P��usA�e�R�{2��e��؜`$�"��6��҉�hB�|Oy�r��3�(y��}�/�R�+G+�ƃVS��ڰ뷃n�N��mgU�`��e�|�ȤGlPY[#�dm&�3��ZJVȄ��چ7a=��e�YG-�5n ��24p�m&��oY�UP��ϲ�T�xsS�Q��Xr�]�GYb^`*��8��|yIEn�U@!��܍��a�ط\�70t�K1�W��7�Da|wwCq�l�9��g1�an�!�AL|��m��[��,�ԛZ�U*2��4�!-�=��_��|��IȨog��Hwr]L��'��}��_��#�O��$J��_�w��}H�~��|�gG��y��Nu9l��K�h�0�u�z��,��N��,3P�wuâs�=�T2G��j�e�yڐ��anAj#1kdB\�a��djN�j��Z��q�L��lJ戮��l>v��PU-��?F1'��9�:��Ҁ{��h��D2��d1τ�S��\<��3G++��$.�P��8.@�'ɔ�1o��Jn�dL�C��o��"�Z�v�ѱ�eu��l�ʱ��flU�RL+��C:gc �7�iH��0��d�Įf��I';�J�&�e��ʍ�,��"b��gg��^�aڷ��M9��`w}W�y<��9.��J��6� Ú"�I��x��t�v�a<��!�X�kzګ�!�n��P��,��eaZ�o~0{g0�V�e��l��*s��c�s�4��<3��N5��ذc�qm$Y��T7E�l2��q��ϧ.��h�lcݜn��ޜ0=*G�\�F��aV ��)��}Y9��V��K�ح�J��N��RWsU��WTe�(�2նZ��hܧ�l��6'��y�W��D�g�s��iu��@*U��Թ,��uE��r�ivbEW�m�lE&N/L8/�f!8ν9�[�~K��uչ��*а ��wsud�-*+~lURx�4�d�m�h�=�c�5l��P�U��v��fev�Ċʦ��m`V��:}��3aTc$�fc�!+��|��)�UĴL8��40lg��અ�Ű�#C�d��s��+y9��.��Q�*=��L\��;@�e⤶s�0��$Sl��Pȉ��%ީOߩ\�2ï�u�,�=3<�c's�� ؾ}`��v��3yId��{�N� m�Z�\(�Y_I��:�.XK�k-;}��t�e��;�J�B��7��Sh�U˖�N�AT.Yh\�{��;h$Q�f ��Ȼ��R6_,sG:��C/��˹��}��Y�" "mz/a��ᯂ�L��O��;��V~SkB�?| ��C`.�O�g��A�%"`��l魱0@�d݄��˭��4d��R��[�ǉS��8�|4*�@� Җ#v-�:*�C8��OT�9��?�O��9<��S 7��bآ��ՠf�W�_h��ל��g��K<3~}�⟲ ��Zw �|�*�G��yt�o��kA9�Fd�ݏ&2B �r \&�"!$��^��x�_�x��!�n/��p&�-0�`*�V��`�j�aڅv>��&:� 3l;��9l4�Μ��%�ɖ�_X$�f��v1�<��ԏ��#,�S;e?�}=�;��p�b_�M0��P\?>�}̵ˆo�L��5~m��gq��g2�$k��-�8��G��1�/_��}ܸ�'��vdp퓜-#!��}fS��WL�e��t��t��VD��Z�sS��#295SrẠ�"�Y{m��t� X��7�$VR��w��U��R!�B'vt;��v�H2x$a�k��h��Qx��Q�"�,B��_��ɢ,�ʽ��m�yBW�~�=rf��0��'LK�(�f��Nd`�v蜷'�21Oܛ�:��O�� sN�2�$[��S��J�f�j!bY`�j�ɵ쏉9��'��/��̰]��#�/��JxN�S#a�Mpcd5a��!��"(��8�Eo:#�YI��b��=��K}:�%d|�%��E��]01,��r~�z��R��FkL{��)��~$�-��U��SE�2�Ky��VF��$�X�]#�� L�cc�n�cg1�ؾ%bG��LB��ߥ��<.��\�<�R��\�lv8o)!�E��F�z�7̴6o��=�X5�5�5ۜ��wا_ ��>۝�u*|�� o|V��+�[�s��hn4��S��s�N-�f̈́er'ϩ=d�^�H�D��<~+NV�X �çB��/�T��S�Fb��h!�x��)�b��X+V1��{o��ل��@��O�[i#�pq0�� n�Q��΢�Md�� |;�G��5لЎr<��tmz�b��}'4��\�Lo��^��115��Ƚ��ºԌFNF��bI��_�Ȥb>:1��?�Q��|�PHȹ�f6��X�N�e@JB�穔�}K3��H��2!�"��OQH�S`S��0=�P aф=�L��31��J��fo@@4��N@�Y�@\n��}��^&��skE�Ga�q�_﩮̶��?��L(��?�M��?�=��T��y�)�d�@`-��w ��@��ǵ/�G1r�H�C-��!~i0z��A��3��K��$3�˂�7�#-��g�z<(*9�~��G��q|Lذ�(K�36 �S97#��G�C|��G@��ŏ�� 4�a48�%m��,r1ɖz�N�@{��s��Y�&��Y�Gp$�\b8��.?��4~1��L�ILm$E��t�{ʛ�!��\aZ4��>&��4}�n�Sa`#�8S�Sݱ��|�iJ��t*7�o��.o��*��U�&>4(?��kD�0�8��w��ۜ:�e�KE��N��Κ�0p$��S!��3WMp��Wxu��3��g��}��>�i��AO�ud*��уM��A��r��^�+p��.yt�r�)�,Ff?B��m��ܴޖ��6��}��4��2�]e��o��/�i秊��:�U˓\}&��&�ݎ��E�x+٭��Y��{%yh}�x��c��rvS�T{�As��6�b�0�k", "��|}��Q�*s~k�ò��^V�R��zT�4V�c.;}��K{z%��h�S|&1-݂�5e��Ujni�c�y�B?��.ew�ę)]M��-t��{�z��|Ĺ¸9��2�ͮĊ9.�饺��t>��u�vk]{�*"͝�{�^ay��ӵ\n�8�:�g�>�:o4�f��M}Do�U޼O]4�8e(��]a}�_]8^e3��e�_}?#ӺgjӘ�Y&l�VbiQw�N�6��B��E�;��s��?>��_X`p��c�ҿbӥk��p�f��ﳵhr�<��AH�iD��`�^�{��q��@2ى��ջ�\��Y�j`�$Y��SDa*��G�x@��|��'z��1�;it��h©K�Z�ɇ�=��d�nsp�q��\��P��]��&=�c?�@0=�.��3�>"5��Hc�Ú$~&�q?d�?9�SK`U��Ȇ�q�L�pMt,3�:��fn,�MH�%�p��x�9X��h�}~SK`��|�Qs��8��^��ss9�X��6�֒��Ofe�E��7�d��^�*S��V��X��}�LN>(S.��VF*J��w��R�p�b��+ �� e��1{��8�O�zh��,�e؄��E��痤�s�l��v�;��,l�Dx�k��/��Cz)i-w�ts�ժ��쒂7��$�KG�;Yx*�ݸ;wvi;�Tn�t7zHW��?�>þr��v�\��C��;��S�[��9\��2��ta�L��]-��=ʞ��^fb��aynR�h��k�]Pż�i��H͟�J�~��%��!��z�Z��5}}�j�VT��g�^2��yN�?W*V��읣", "{c�n�dB��E��"��&]{��!-�ĺ4x7!�5�&�>�6��:\B�jv��d�i�Ȝ�~=<��y��)��}�p�k�F��!�#��>U~n��!�n�b5f�;��Ya��{q�i湕/<�s�|>��v��w��q��U�~zo��^�y%uv��Y�!�E��^?2&\U��d�t[냝sѭ#�.��Z�\��}iH�!��R�Ջ��p��~;��!ܨM�E|��?��~H��$[)�u|3}��T�5��`\��^��u=�޷��ڜ��w?w��ϕ��:�}]/��"�|��^H�Tj46*��Sf��7��{��6&�L��n�qa<�ߍ��m�9p�W�s*��׵��S��Z��t<��p��C�i�*đ�Q�z�D��\��`r.�f��jj4��O7g˕�~:��K�ճi��!:&��|*��/��2~l�1�/��e�9�x�b��thb��h�׃�>�.ʇ��bȖ��V�\6B�|>m��.gW��j��l�{��lq~^�?kW�W��:��~nHyH?�F��!��^|��oo��d&5M��8}⛟�n��Gw��T��'o~��)n�;�;Ie�/M��1Hm��g ��Ӣs��!�֣Q:c��.2��r�j��ztp�};6m��3p�nmJ�P��L��G��{p��<�O��|��p>1�m��!]z��&�!�>��\��KۙB>��z��3p�љ.�R�]��]��zs�~��!��H��{��>��i�ё�83[�?a��f@G%Nǲ0Y��BA_��Xi�u{?�S~Q��+Nǳ8��^*sq�H7�W��8��)��W�Ct�sZ��~�Ӗ�w��Si��u:�y'c�Ø܏�͟2{��`U�B�Y��K�8�ܴKU�Ͷ߭7�7��J��:�7��xsS�f��kI�/u�O��Ѹ�'n�,��*u.foo*�C��wY�ݿ��̅S(gۍ��a�Y��{q;|�Pukjq��7�^�;��ʻq�Va�-ワR}\��6��\���)��[�^Ψ��?�4],r��w��x@�<�V驨۽;8A�iv9|쿟��H��(^��Cz��`}/!n��g�n�90��)�/hi�~�]��u", "w_5j��S�!ktP';)]��K�E_e��x�ޛ��]�xPEC��n͇��?��~�%��W]��NB�Ѹ��˫r�`��'��7��;nTd�4�q�W��!:ƕ�e��t��c4�.�ҕ3=��J�\��n�чt�4��t�6��Or��{|��ܬ�z�`b��^��6{O��dp�Ѫ��Oh=S/��d��C��q�S"��T.G7��ˇ�"��׳��q��o��PXen��Y�E��x(�զ_��x_�z�b�cQ�QLv!�%)(��p�2�1��#5��g��*a.9F��m<�ԍZ��/j&�� }σ./5��UHD�^4A�<��Ra��¯p"��cJ.�iQƚ0d�G}�OvDb#9�f�oPb.a��QD;'c4Qȯ�� <��F��^b~��u߼�to�(T7��X�|y�CJ��I��ޑ\&�.l��|��]��{Y�F=��M-��IŶ��@l>�"APj��n�� z$��:9��ww$�A�e�� 1)�<�p�� P0ۋ"��D�Ż.�4�KW�_΂�(b*�� (.�A�Oq�Dq'QH��BD�q��m�h�<ڪ��h�6�c[�ц��7��h�/ڈ��Ţ��/�E��q��e2�߈vb��D9�#��8w�z4b��A��O��V4��a#%��G4*�w(�S��5.j��5Y�4�H�>e��z9��;gA��t�o��!`�", "f��!��6��^C!��a��#�xT�+�t�B�ގ��o�/Ԁ��9�L��A��վ�j��z�Ĳw�V4%�S�{-��4s4��<8��C��p��(O��|e��8}@o}��gI~�ڧz��؁G��x\�."��G8pW�56xc��x�r��Y{�-��b�YK�}µ��k�HE�Q$\��D*(?{�7q��*.H��mH��G��`��6��)��ޫ~��s��z"�?�Y��: SX{x��`?$�<��X��"�.D��WL�w��_I��ո��s�g�R�\�я�둷{g��ޣ��m6ዼ�ܚ�b��vp�M"��f+�(�u+�n�隵�{=�t��A�ui$�Ѱ��qM��h�7�E�B��脘bG˾92�*�|��/d�'��ӋA�~��L2�=��@4�~��Ȃ�GG��^*��|��Δ��YLr��I�#�%�r��R�,9@}3W�w��_=)??�ZI��6>)��SWd�|U8��[gj~ےPJ7��S��3�.+�A��U��u�:�w�s�u^�:�$�\l�Kىk�<��'��;iq#睱T��csD�'��~Y�{��T�k<��jk� W��1��t!�ڝ�$?^կR��)��g��s\��F�!�Z�5��I{��-rm��)QSy.4%�k�R�´[��D�W�/�+�5��j8hƫV�P}��g�ɨY�֣��,?)�ݞW��3��*�O��r�/:��i��1�jn]0��:ˊ�6�%!��={a�V�x�Ў~Sp<��l#��DF��Q#�-�9X�ؐMK�l{��$c��>�:5��AR\D]�͌&�C�Uj�{�4�6 .W�p��Ђ?u�2��U�3�?�Өg��٭�flv�"�7`SptȰ�þc�50��K�.��_2�e�'��y�u��[gv?�", "�mЁ�ؾ�q��Y��ᅑ4j��[��z6��t/�ɠ�a�1��op�{S5̾H�&[�+�e2��=#�߹O{��h��ˇ�5��f��;7�[5��f�F�X8|Y`C��avK1�]c��욗x�Hdy�"/x?{i�{�Yl��G��>�):��?c{��m�;��{��6ޤ�*�ѳ�ڄ�C��]��~��ze�^��۞Ʀ��Lf��߷�O��gÅ��P5F�F�Iw.,�S��,�=6Xv��7�^�f��0E��dF�_��%��pu��̣�}�<�̊�9��a��W�X502=;Z1g��յi-eb�q�V�O��Ԭ屍){$�T�G�A0��Mk�\2'�$�ul��2K��ܠ:��p��ת��ցu{��аG/_�>}��e�Lz�ƍ��ߨ��Ħ�[��ﱓB3)�Ȧ��JHgƙ�Ryѯ�K��IH �T`i��??��_��Zs��ï�W��Dm,��_;��پ./.�i�ÿ��_ޙ��T�Z�/��_승��1%��O��-tB�sN�<��b�saW��׋��C�_G��Ӕ^iz�>޿!�4=|9�_��4=|S�aB|��櫮Ec�~��x^&>m�IG_��Bb&��O:��Ư�᫠[T��j�S�'|�U�ϙ��]GF�B�~��{^��Cz��z�'��gj�U.D-��O:��8V�nQ;~v+�� :@�c[��Ա��;(|��2,s��}��$��s,L0�ܫ�G��va��m6��ڽq�}��vM�`c"I��S��1i G2�f��0�o��s!�%9u�}�u��ؓ'_)^��+xy��?��Oĸ}��ձ�{f��oH��`��U� 3�L� �Ų�)�b�P6��?��", "7a7�][o۸�/zfa�jI�'9��{��6h��U�R)�v��o(Y��}X��C��Mΐ�=�N�d��t�[w�d0+ᤋf��ٕ��,3C|��*�q��1�Ne�%��V�I&ע�ԁS`�V�]yǓ��y��!�6-��D-��8C��k>��*/�E�?_\M��x1��ﰾ3��T�B�US�E�uR�k�:�|>i燚��4aʺ&��L�d_�R�z&Em�b-��8?�J��WEǭ��A/歔�(��<ѵ�bm$m�Th�w�>g=֮�3ܼi�F��L��k��d�o��W��Q�(4��RYR�/��3�@Q7ld��&B��CbUp��G��cd�&�s��dl��3?�=0�>_!��;��2%X�Z�3�h1Jy��,C{�5�"޽>�֠��Rat�`��0�L�b;�a4�O��Rh,��$Qi�+$��㞽!��z~hۮ��'��>D��/tm;@_��u�闿"o�햂�|�ǎB��c��5��@��Oc�7��$��dz��1+��?-̼D?GS�k3��[�t�<�*B'id��R��K�,�D¿O^փVk�&bS��K�l#a��R��:OWR%Z�.%�U+p�(�c��MM�\�:�}�|��%��(;_��@WI�a��Up� s��7��Dn�*�Qx��*=R�r�B�|k̂��&�F�պmE��q9A�3�X:h��Αp�T�z׋G��զȒLUOI��3��i�N��1l�h�8<�bH�.�qVȑ(��HW�=�U�C�Nq�'/ǓՀ�-.6�o=|�\�� d�W"�,94IL)e�o6E��SsG/J��2E[n&��ߪEk�!�}{7��fb])��U��I��K��F�5��v�Eδ�<��8=ʟm�w:n��b��L�Mk;�ᤐi�u�=��ud�P�M�xBV�??�p�l�:Aj��#��N��U/��뻮O��s�Z�}S�y��z�Bcwo>^�e��ZR��Db]hK��ϼhضám^#�2�/U�"$�`�N�^��C��s�o�߯F��9��y��ՈT�$_�|��yUNU��*B�O�I��:��V�ъ��x�]�g��#<�.Y��C��'�>��I�O��~��rد{��o��7d�,�w݆{�c3��Ӓ�6ָ˹�{̑�'�>�k��ȳ!!��t��'#;3��#2İ��9�ɐ��>>�-6�tp6��g:�Y��*U;�c{[��Y;l9�w��0"m"��_��Z�)݉7'�f:a��M"��V�-l��m��iHD�J��*>{�m0S�d��)��a��Z�K�Cb-U�F�L2��F�", "�o��c#Z��&�)z��n$�%d�M��8�R��v<�$��1$��}렿��q« �r�l��E��y;��^�4=��N/s�ū� &�퐖��^V�z��J��7�.�"�(�w�F� �.5No.�~��x_L��i\�/�z^Vs=?�F��8^��+�޶_�D��+��,��+LL�&H��x�_�7߿ڂ�~��Mgp��&;��#��m�)6.��eN�ڑ)ki�Z�s��zϚ�h!��O��t��<�B�@�˞�W��US�g�w"2��o�S��b�+�g�ip�Y��S0�u�� m��v��~+�L1&�Y�/�~c�r}?��z��8J;�e��.��y�Sҹ$�+��c�s{v��]��ܭ��N��˟�*��`Y��_��0��0", "GET / HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKA;Path=/;Expires=Mon 20-Oct-2025 04:15:07 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-3M8xJbhHJSOHEt5OQUXY5w' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sat 21 Oct 2023 04:15:07 GMTExpires: Sat 21 Oct 2023 04:15:07 GMTCache-Control: private max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKAConnection: Keep-AliveAccept-Language: en-US", "0000000100000001�000000010000ea��PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxc9j3I_1S7Zx5oFmB3gIptNPTS0tFpbP01k7PqX5uyojwfG1lDqsMrFiVPzveau1EuvwzdaQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKAConnection: Keep-AliveAccept-Language: en-US" "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1190735428%3A1697861707858787&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ltLdG07NTnFg5cO5kNUoma8rtdR_bA:25P4qcj7uaTOkxKAConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 21 Oct 2023 04:15:07 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxc9j3I_1S7Zx5oFmB3gIptNPTS0tFpbP01k7PqX5uyojwfG1lDqsMrFiVPzveau1EuvwzdaQStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-UzYJZi1qu_DposoXigQeuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy: unsafe-nonePermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 21 Oct 2023 04:15:07 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1190735428%3A1697861707858787&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsReport-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Security-Policy: script-src 'nonce-RXMIZNtQaWZqQBhKgJeXKg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportContent-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked"56:T6949,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "[@k;.pk" Heuristic match: "KQ.tl" Heuristic match: "1Op.TR" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "https://www.facebook.com/legal/license/WRsJ32R7YJG/__d" Pattern match: "rsrc.php/v3/yB/r/TwAHgQi2ZPB.png" Pattern match: "http://example.com" Pattern match: "https://www.facebook.com/legal/license/t3hOLs8wlXy/__d" Pattern match: "http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crlXB*?z`K" Pattern match: "http://crls.pki.goog/gts1c3/moVDfISia2k.crlzg" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl.http://crl4.digicert.com/sha2-ha-server-g6.crl0,Mt*u|%'k" Pattern match: "https://fonts.googleapis.com/css?family=YouTube+Sans:500" Pattern match: "rsrc.php/v3/yD/r/MKQzjVd1bVq.png" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921722083261443106786196376900931065058VISITOR_INFO1_LIVEhB5RSPdOt7kyoutube.com/9217704435203110125596376900931065058VISITOR_PRIVACY_METADATACgJVUxICGgA" Pattern match: "https://fonts.google.com/license/googlerestricted@font-face" Pattern match: ".AAA.0.0.BlM1BM.AWVp84dZCH4facebook.com/921737333760031083150333489509831065053TFAzZVgr1S8d_QU46vDXH_ljfacebook.com/9217191779174431145511273673909831065053_js_datrTFAzZZgXOlSW1ct6EXlrmfnofacebook.com/1089341315148831145522225428226131065056" Pattern match: "MUIDB142650D6D196682315C34367D01269A1www.msn.com/9216391199129631143499317796253731065123sptmarketen-us||us|en-us|en-us|en||RefA=0C1537925F3E49C8BA1DA21472542D4A.RefC=2023-10-21T04:16:00Zwww.msn.com/1024174542028831212097407458653831065123" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921722083261443106786196376900931065058VISITOR_INFO1_LIVEhB5RSPdOt7kyoutube.com/9217704435203110125596376900931065058" Pattern match: "9216391199129631143499317796253731065123MUID142650D6D196682315C34367D01269A1msn.com/1025391199129631143499317796253731065123USRLOCmsn.com/9217174542028831212097407458653831065123" Pattern match: ".AAA.0.0.BlM1BM.AWVp84dZCH4facebook.com/921737333760031083150333489509831065053TFAzZVgr1S8d_QU46vDXH_ljfacebook.com/9217191779174431145511273673909831065053" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921722083261443106786196376900931065058" Pattern match: "9216391199129631143499317796253731065123MUID142650D6D196682315C34367D01269A1msn.com/1025391199129631143499317796253731065123" Pattern match: "-6iLRpaccounts.google.com/9217117384678431211896416680826831065145" Pattern match: ".google.com/9217116384678431211896356834026731065145" Pattern match: "x5PcjTRaFEieygljaccounts.google.com/921758384678431211896102688325731065057" Pattern match: "25P4qcj7uaTOkxKAaccounts.google.com/921750384678431211896370962238331065052" Pattern match: "pNAU0C5XS04akBLgaccounts.google.com/92171223846784312118966269362531065152" Pattern match: "CheckConnectionTempCookie290631674accounts.youtube.com/accounts/2147484752196473100831065152186596963031065152" Pattern match: "CheckConnectionTempCookie35412460accounts.youtube.com/accounts/2147484752323662412831065057314665229331065057" Pattern match: "MUIDB1150E0A339946CEC15EAF31238106DFDieonline.microsoft.com/9216390199129631143499382829580631065122" Pattern match: "MUIDB142650D6D196682315C34367D01269A1www.msn.com/9216391199129631143499317796253731065123" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/108810266241283106505742868325331065057" Pattern match: "MUID142650D6D196682315C34367D01269A1msn.com/1025391199129631143499317796253731065123" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Pattern match: "www.facebook.comDNT" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxc9j3I_1S7Zx5oFmB3gIptNPTS0tFpbP01k7PqX5uyojwfG1lDqsMrFiVPzveau1EuvwzdaQ" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxc9j3I_1S7Zx5oFmB3gIptNPTS0tFpbP01k7PqX5uyojwfG1lDqsMrFiVPzveau1EuvwzdaQStrict-Transport-Security" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&passive=1209600&flowName=GlifWe" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Content-Encoding" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://accounts.google.com/ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidV" Pattern match: "https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&theme=glif" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https://accounts.google.com/&ifkv=AVQVeyxk0D0N8z1_RJwrecTANE2iNbf57L4FFP4RMrIdNhzHmnxwJSe-tWTFqzdlwkdlDidVW_oK-g&theme" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&flowEntry=ServiceLogin&flowName=GlifWebSignIn&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzQsPFyXE8lpN_u-CO1t6Jyi1zYVqdvPyZ5WAmYWoa8yAqr6X3POSnehhu3" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Accept-CH" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Permissions-Policy" Pattern match: "rsrc.php/v3/yL/l/0,cross/GLMTwJKTA1g.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yy/l/0,cross/wYnUPpbC_DL.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y8/r/RNFuSb7tdaZ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yX/l/0,cross/fpMCwgcFvo4.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y9/l/0,cross/2W2z89vRC58.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yx/l/0,cross/7O04Eyj-1fg.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yI/r/4aAhOWlwaXf.svg" Pattern match: "Y-.YU/Ҍc]�'�Ī�*" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "rsrc.php/v3i7M54/yv/l/en_US/uwjyy7pmA-B.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yB/r/Y0L6f5sxdIV.png" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/y1/r/P8DLAFRlDfy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yg/r/ju4lCUCaD5F.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yq/r/C9n9XTZa3H8.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y1/r/dXk5exdOVhk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yj/r/MAz3ivwtIyN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ys/r/xEUODc7mbZF.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/zI56j6esQGz.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yP/r/bisOS4dl-mS.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yo/r/xqvNY4MTESs.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3iqES4/yr/l/en_US/1xoiPcaOOYU.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y7/r/QJ_ErdZuyUE.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language" Pattern match: "www.youtube.comDNT" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FStrict-Transport-Security" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube_main}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}Content-Length" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "https://accounts.google.comAccess-Control-Request-Method" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\-5417874174459294613\,3,[null,\S-1190735428:1697861707858787\]],null,null,null,null,null,null,-7200,null,null,null,null,[],1,null,null,null,null,null,[]],[1697866797000,null,[],null,null,nu" Pattern match: "https://accounts.google.comAccess-Control-Allow-Methods" Pattern match: "g.co/p3phelp" Pattern match: "https://accounts.google.comCross-Origin-Resource-Policy" Pattern match: "accounts.google.com/v3/signin/identifier\,null,[\\],0]],\8195382914654326055\,3,[null,\S-1476075590:1697861774078056\]],null,null,null,null,null,null,-7200,null,null,null,null,[],1,null,null,null,null,null,[]],[1697907264000,null,[],null,null,nul" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.8dPAf41KP2A.L.B1.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlG_feASRxywwl-DUEHUHQxHjOTzug/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFJI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHlvGH0uOdIItMZ5p_iAU8jYD9fsA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/b926992e/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "https://www.youtube.com" Pattern match: "https://accounts.google.com" Pattern match: "com.google.android.gms/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver,com.google.android.gms.supervision/com.google.android.gms.kids.account.receiver.ProfileOwnerReceiver" Pattern match: "https://www.google.com/log?format=json&hasfast=true:https://play.google.com/log?format=json&hasfast=true" Pattern match: "https://play.google.com/log?format=json&hasfast=true;this.Ma=!0;this.Ja=!1;this.Qg=;this.oa=this.aa=this.da=!1;this.network=new" Pattern match: "https://policies.google.com/terms+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+(g?&color_scheme=+_.rz(g):)+((null==e?0:e.X9)?#infocollect:);break;case" Pattern match: "https://play.google.com/intl/+_.rz(l)+/about/play-terms/embedded/+(g??color_scheme=+_.rz(g):);break;case" Pattern match: "https://www.youtube.com/t/terms?chromeless=1&hl=+_.rz(l);break;case" Pattern match: "https://policies.google.com/privacy+(f?/embedded:)+?hl=+_.rz(d)+&gl=+_.rz(c)+(g?&color_scheme=+_.rz(g):)+#inforetaining;break;case" Pattern match: "https://policies.google.com/privacy/additional+(f?/embedded:)+?hl=+_.rz(d)+&gl=jp+(g?&color_scheme=+_.rz(g):);break;case" Pattern match: "http://+this.ea.substring(this.Ca.length)" Pattern match: "http://www.w3.org/XML/1998/namespace:0===b.lastIndexOf(xlink:,0)?http://www.w3.org/1999/xlink:null" Pattern match: "http://www.w3.org/2000/svg:math===a?http://www.w3.org/1998/Math/MathML:null==d||foreignObject===IB(d).da?null:d.namespaceURI" Pattern match: "https://www.w3.org/2000/svg'+" Pattern match: "https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg" Pattern match: "https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_48dp.png" Pattern match: "https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png" Pattern match: "https://ssl.gstatic.com/accounts/animation/+_.sz" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_device.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/ble_pin.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/usb_key.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_phone.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/paaskey.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkeyerror.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/passkey_success.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_keys.svg" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-password.svg" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif" Pattern match: "https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif" Pattern match: "https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_updated.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/installing_family_link_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_location_sharing_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_parental_controls_0.svg" Pattern match: "https://ssl.gstatic.com/kids/images/onboarding/set_up_school_time_0.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif" Pattern match: "https://ssl.gstatic.com/accounts/marc/screenlock.png" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif" Pattern match: "https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif" Pattern match: "https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png" Pattern match: "https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg" Pattern match: "https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg" Pattern match: "https://ssl.gstatic.com/accounts/embedded/kid_success.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg" Pattern match: "https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter.svg" Pattern match: "https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter.svg" Pattern match: "https://www.w3.org/2000/svg" Pattern match: "https://accounts.google.com/TOS?loc=+_.rz(a.zW)+&hl=+_.rz(b)+&privacy=true" Pattern match: "https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072" Pattern match: "https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png" Pattern match: "https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg" Pattern match: "https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg" Pattern match: "https://g.co/recover" Pattern match: "https://play.google.com/work/enroll?identifier=+_.gi(a)" Pattern match: "a.rb/1E3/c,this.da=-1==this.da?a:.3*a+.7*this.da" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.QUjh89dKB-E.L.I11.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlGTvDS36C4lRk2g_V6AKIwWhiCPVw/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHK_6NZi0yeSin1ommAktmAN0EneA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff" Pattern match: "ww.reddit.com/r/gifs" Pattern match: "reddit.com/r/gifs" Pattern match: "www.reddit.com/r/gifs" Pattern match: "w.reddit.com/r/gifs" Pattern match: "www.facebook.com/login" Heuristic match: "ccounts.google.com" Heuristic match: "acebook.com" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "instagram.com/justinbieber" Pattern match: "w.instagram.com/justinbieber" Pattern match: "www.instagram.com/justinbieber" Pattern match: "www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F"57:T1ab0,Found URL "http://5.42.92.88/]" - Source: "00000000-00000628.00000000.66340.004E0000.00000004.mdmp") Found URL "http://5.42.92.88/loghub/mastersxftlmemlmemb>eee